Fuel CMS
Source repositories
CVEs (40)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16416 | Hig | 0.57 | 8.8 | 0.01 | Sep 3, 2018 | Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password. | ||
| CVE-2026-30461 | Hig | 0.54 | 8.3 | 0.01 | Apr 15, 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule. | ||
| CVE-2026-30463 | Hig | 0.50 | 7.7 | 0.00 | Mar 26, 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component. | ||
| CVE-2020-24950 | Hig | 0.50 | 8.8 | 0.01 | Aug 11, 2023 | SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items. | ||
| CVE-2026-30459 | Hig | 0.46 | 7.1 | 0.00 | Apr 16, 2026 | An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message. | ||
| CVE-2024-57605 | Med | 0.35 | 5.4 | 0.00 | Feb 12, 2025 | Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components. | ||
| CVE-2024-25369 | Med | 0.35 | 5.4 | 0.00 | Feb 22, 2024 | A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. | ||
| CVE-2020-22152 | Med | 0.35 | 5.4 | 0.01 | Jul 3, 2023 | Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function. | ||
| CVE-2022-28599 | Med | 0.35 | 5.4 | 0.01 | May 3, 2022 | A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack. | ||
| CVE-2022-27156 | Med | 0.35 | 5.4 | 0.00 | Apr 11, 2022 | Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection. | ||
| CVE-2021-44607 | Med | 0.35 | 5.4 | 0.00 | Feb 24, 2022 | A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. | ||
| CVE-2020-23721 | Med | 0.35 | 5.4 | 0.01 | Mar 10, 2021 | An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english. | ||
| CVE-2020-26046 | Med | 0.35 | 5.4 | 0.01 | Jan 5, 2021 | FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors. | ||
| CVE-2019-15228 | Med | 0.35 | 5.4 | 0.01 | Aug 20, 2019 | FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors. | ||
| CVE-2018-20137 | Med | 0.31 | 4.8 | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | ||
| CVE-2018-20136 | Med | 0.31 | 4.8 | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. | ||
| CVE-2021-38725 | Med | 0.00 | 5.3 | 0.01 | Sep 9, 2021 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php | ||
| CVE-2021-38721 | Med | 0.00 | 6.5 | 0.01 | Sep 9, 2021 | FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability | ||
| CVE-2021-38290 | Hig | 0.00 | 8.1 | 0.01 | Aug 9, 2021 | A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing. | ||
| CVE-2020-28705 | Med | 0.00 | 4.3 | 0.01 | Mar 10, 2021 | FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. |
- risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.
- risk 0.54cvss 8.3epss 0.01
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
- risk 0.50cvss 7.7epss 0.00
Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
- risk 0.50cvss 8.8epss 0.01
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
- risk 0.46cvss 7.1epss 0.00
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.
- risk 0.35cvss 5.4epss 0.00
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
- risk 0.35cvss 5.4epss 0.01
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
- risk 0.35cvss 5.4epss 0.00
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
- risk 0.35cvss 5.4epss 0.00
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.
- risk 0.35cvss 5.4epss 0.01
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.
- risk 0.35cvss 5.4epss 0.01
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
- risk 0.31cvss 4.8epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
- risk 0.31cvss 4.8epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.
- risk 0.00cvss 5.3epss 0.01
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- risk 0.00cvss 6.5epss 0.01
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- risk 0.00cvss 8.1epss 0.01
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
- risk 0.00cvss 4.3epss 0.01
FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
Page 2 of 2