CVE-2026-39229

{"id": "CVE-2026-39229", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39229", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T19:29:38.904897Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-29T16:16:26.723", "references": [{"url": "https://boltcms.io/", "source": "cve@mitre.org"}, {"url": "https://github.com/Tonoss-412/My-CVE/blob/main/CVE-2026-39229.md", "source": "cve@mitre.org"}, {"url": "https://github.com/bolt/bolt", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information"}, {"lang": "es", "value": "Bolt CMS hasta la versi\u00f3n 3.7.0 permite inyecci\u00f3n SQL en el par\u00e1metro 'order' de las p\u00e1ginas de listado de contenido. Un atacante autenticado con privilegios de bajo nivel puede explotar esto a trav\u00e9s del componente OrderDirective. Esto permite la extracci\u00f3n de informaci\u00f3n sensible."}], "lastModified": "2026-07-21T15:10:00.103", "sourceIdentifier": "cve@mitre.org"}