{"id":"CVE-2019-9553","aliases":["GHSA-2g23-qmmp-fvmr"],"url":"https://o3.security/vulnerability/CVE-2019-9553","summary":"Bolt Cross-site Scripting via the slug, teaser or title parameters","details":"Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.","published":"2019-12-31T17:15:11.160Z","modified":"2026-08-07T16:35:37.627515Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":3,"affectedPackages":[{"ecosystem":"Packagist","name":"bolt/bolt","fixedVersion":null}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.html"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/46495"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T16:35:37.627515Z"}}