What’s Vulnerable › Vulnerabilities

CVE-2026-39229

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-29 · updated 2026-07-21
• Weakness: CWE-89

Description

Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information

References

• https://boltcms.io/
• https://github.com/Tonoss-412/My-CVE/blob/main/CVE-2026-39229.md
• https://github.com/bolt/bolt

Get alerted when CVE-2026-39229 or the next vulnerability affects your stack