Vulnerabilities

Filters

Reset all

1 selected

40 records

Sort

Vendor: Thedaylightstudio Clear all filters

TI-2026-23530 CVE-2026-30459 · GHSA-c29w-82wc-qh7v

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows…

MEDIUM 64

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00263 Published 2026-04-16 No fix listed CWE-640

TI-2026-23532 CVE-2026-30461 · GHSA-q6p9-89h2-c9h9

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code…

HIGH 71

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00526 Published 2026-04-15 No fix listed CWE-77

TI-2026-23531 CVE-2026-30460 · GHSA-crp2-42r4-6427

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code…

HIGH 73

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00825 Published 2026-04-07 No fix listed CWE-94

TI-2026-23534 CVE-2026-30463 · GHSA-gc3c-8x8c-pxx8

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability…

HIGH 67

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00321 Published 2026-03-26 No fix listed CWE-89

TI-2026-23529 CVE-2026-30458 · GHSA-8vgv-ffv5-269j

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password…

HIGH 80

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00371 Published 2026-03-26 No fix listed CWE-620

TI-2026-23528 CVE-2026-30457 · GHSA-vhm5-27gh-m6xq

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers…

MEDIUM 50

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00656 Published 2026-03-26 No fix listed CWE-94

TI-2024-37959 CVE-2024-57605 · GHSA-wr4g-hvjj-f7fp

Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker…

MEDIUM 58

Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00325 Published 2025-02-12 No fix listed CWE-79

TI-2024-16708 CVE-2024-25369 · GHSA-4x8h-5jjw-88xr

A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to…

LOW 27

A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00379 Published 2024-02-22 No fix listed CWE-79

TI-2020-15255 CVE-2020-24950

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS…

HIGH 73

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01378 Published 2023-08-11 No fix listed CWE-89

TI-2020-14275 CVE-2020-22153 · GHSA-9hxv-976m-pg77

File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute…

HIGH 82

File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01453 Published 2023-07-03 No fix listed CWE-434

TI-2020-14274 CVE-2020-22152 · GHSA-hg7v-8vvq-mgph

Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote…

MEDIUM 58

Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00576 Published 2023-07-03 No fix listed CWE-79

TI-2020-14273 CVE-2020-22151 · GHSA-ww86-3cc2-9g27

Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute…

HIGH 82

Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01453 Published 2023-07-03 No fix listed CWE-434

TI-2023-16579 CVE-2023-33557 · GHSA-75qp-p9hp-3wfg

Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.

HIGH 73

Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00803 Published 2023-06-09 No fix listed CWE-89

TI-2021-14806 CVE-2021-36570 · GHSA-5252-f7h5-9fg4

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to…

HIGH 73

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00732 Published 2023-02-03 No fix listed CWE-352

TI-2021-14805 CVE-2021-36569 · GHSA-pgjr-c8r8-wr55

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to…

HIGH 73

Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00428 Published 2023-02-03 No fix listed CWE-352

TI-2021-19830 CVE-2021-44117 · GHSA-xx7w-qc27-vx8w

A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS…

MEDIUM 41

A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01375 Published 2022-06-10 No fix listed CWE-352

TI-2022-11251 CVE-2022-28599 · GHSA-qfcc-5rr7-8fg9

A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an…

LOW 25

A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00573 Published 2022-05-03 No fix listed CWE-79

TI-2022-10284 CVE-2022-27156 · GHSA-7gwc-hcrh-r68c

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.

LOW 25

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2022-04-11 No fix listed CWE-79

TI-2021-20168 CVE-2021-44607 · GHSA-r2j7-cpgf-7qq3

A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.

LOW 25

A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-02-23 No fix listed CWE-79

TI-2021-16288 CVE-2021-38727 · GHSA-qq7c-vp73-p9c7

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items

MEDIUM 45

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01622 Published 2021-09-09 No fix listed CWE-89

TI-2021-16285 CVE-2021-38721 · GHSA-p9jm-j7j3-qc5g

FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability

LOW 30

FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00599 Published 2021-09-09 No fix listed CWE-352

TI-2021-16286 CVE-2021-38723 · GHSA-v675-xwpf-pp6q

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items

MEDIUM 40

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01002 Published 2021-09-09 No fix listed CWE-89

TI-2021-16287 CVE-2021-38725 · GHSA-ff36-v98j-xr5x

Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php

LOW 26

Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00875 Published 2021-09-09 No fix listed CWE-307

TI-2021-15905 CVE-2021-38290 · GHSA-7hhp-9v6r-9h4x

A host header attack vulnerability exists in FUEL CMS 1.5.0 through…

LOW 38

A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01294 Published 2021-08-09 No fix listed CWE-74

TI-2020-17390 CVE-2020-28705 · GHSA-8c4g-99xj-x4p5

FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can…

LOW 21

FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00585 Published 2021-03-10 No fix listed CWE-352