Vendor CVEs
Thedaylightstudio
All CVEs
25 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16762 | Cri | 0.64 | 9.8 | 0.01 | Sep 9, 2018 | FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items. | ||
| CVE-2026-30460 | Hig | 0.57 | 8.8 | 0.01 | Apr 7, 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module. | ||
| CVE-2018-16416 | Hig | 0.57 | 8.8 | 0.01 | Sep 3, 2018 | Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password. | ||
| CVE-2026-30461 | Hig | 0.54 | 8.3 | 0.01 | Apr 15, 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule. | ||
| CVE-2021-47980 | Hig | 0.46 | 7.1 | 0.00 | May 16, 2026 | Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL… | ||
| CVE-2026-30459 | Hig | 0.46 | 7.1 | 0.00 | Apr 16, 2026 | An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message. | ||
| CVE-2026-38948 | Med | 0.35 | 5.4 | 0.00 | Apr 28, 2026 | Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize uploaded SVG files, allowing a low-privileged authenticated user to upload a crafted SVG file containing malicious code. | ||
| CVE-2024-57605 | 0.00 | — | 0.00 | Feb 12, 2025 | Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components. | |||
| CVE-2024-25369 | 0.00 | — | 0.00 | Feb 22, 2024 | A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. | |||
| CVE-2020-22152 | 0.00 | — | 0.01 | Jul 3, 2023 | Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function. | |||
| CVE-2020-22151 | 0.00 | — | 0.01 | Jul 3, 2023 | Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function. | |||
| CVE-2023-33557 | 0.00 | — | 0.01 | Jun 9, 2023 | Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php. | |||
| CVE-2021-36570 | 0.00 | — | 0.01 | Feb 3, 2023 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. | |||
| CVE-2021-44117 | 0.00 | — | 0.01 | Jun 10, 2022 | A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4. | |||
| CVE-2022-27156 | 0.00 | — | 0.00 | Apr 11, 2022 | Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection. | |||
| CVE-2021-38721 | 0.00 | — | 0.01 | Sep 9, 2021 | FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability | |||
| CVE-2021-38723 | 0.00 | — | 0.01 | Sep 9, 2021 | FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items | |||
| CVE-2021-38725 | 0.00 | — | 0.01 | Sep 9, 2021 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php | |||
| CVE-2021-38290 | 0.00 | — | 0.01 | Aug 9, 2021 | A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing. | |||
| CVE-2020-26045 | 0.00 | — | 0.02 | Jan 5, 2021 | FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | |||
| CVE-2020-26167 | 0.00 | — | 0.03 | Nov 4, 2020 | In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. | |||
| CVE-2019-15228 | 0.00 | — | 0.01 | Aug 19, 2019 | FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors. | |||
| CVE-2018-20188 | 0.00 | — | 0.01 | Dec 17, 2018 | FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. | |||
| CVE-2018-20137 | 0.00 | — | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | |||
| CVE-2018-20136 | 0.00 | — | 0.01 | Dec 13, 2018 | XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. |
- risk 0.64cvss 9.8epss 0.01
FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.
- risk 0.57cvss 8.8epss 0.01
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
- risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.
- risk 0.54cvss 8.3epss 0.01
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
- risk 0.46cvss 7.1epss 0.00
Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL…
- risk 0.46cvss 7.1epss 0.00
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- risk 0.35cvss 5.4epss 0.00
Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize uploaded SVG files, allowing a low-privileged authenticated user to upload a crafted SVG file containing malicious code.
- CVE-2024-57605Feb 12, 2025risk 0.00cvss —epss 0.00
Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.
- CVE-2024-25369Feb 22, 2024risk 0.00cvss —epss 0.00
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.
- CVE-2020-22152Jul 3, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
- CVE-2020-22151Jul 3, 2023risk 0.00cvss —epss 0.01
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
- CVE-2023-33557Jun 9, 2023risk 0.00cvss —epss 0.01
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
- CVE-2021-36570Feb 3, 2023risk 0.00cvss —epss 0.01
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
- CVE-2021-44117Jun 10, 2022risk 0.00cvss —epss 0.01
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
- CVE-2022-27156Apr 11, 2022risk 0.00cvss —epss 0.00
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
- CVE-2021-38721Sep 9, 2021risk 0.00cvss —epss 0.01
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- CVE-2021-38723Sep 9, 2021risk 0.00cvss —epss 0.01
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
- CVE-2021-38725Sep 9, 2021risk 0.00cvss —epss 0.01
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- CVE-2021-38290Aug 9, 2021risk 0.00cvss —epss 0.01
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
- CVE-2020-26045Jan 5, 2021risk 0.00cvss —epss 0.02
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
- CVE-2020-26167Nov 4, 2020risk 0.00cvss —epss 0.03
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
- CVE-2019-15228Aug 19, 2019risk 0.00cvss —epss 0.01
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
- CVE-2018-20188Dec 17, 2018risk 0.00cvss —epss 0.01
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
- CVE-2018-20137Dec 13, 2018risk 0.00cvss —epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
- CVE-2018-20136Dec 13, 2018risk 0.00cvss —epss 0.01
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.