CVE-2026-39229

—

CVSS 3.1

6.5 medium

EPSS

<1%p15

Published

May 29, 2026 (May 29, 2026)

Modified

Jul 21, 2026

Description

Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information

Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.