Show filters
32 Total Results
Displaying 1-10 of 32
Sort by:
Attacker Value
Very High
CVE-2018-16763
Disclosure Date: September 09, 2018 (last updated November 27, 2024)
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.
1
Attacker Value
Unknown
CVE-2020-24950
Disclosure Date: August 11, 2023 (last updated October 08, 2023)
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
0
Attacker Value
Unknown
CVE-2020-22153
Disclosure Date: July 03, 2023 (last updated October 08, 2023)
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
0
Attacker Value
Unknown
CVE-2020-22152
Disclosure Date: July 03, 2023 (last updated October 08, 2023)
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
0
Attacker Value
Unknown
CVE-2020-22151
Disclosure Date: July 03, 2023 (last updated October 08, 2023)
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
0
Attacker Value
Unknown
CVE-2023-33557
Disclosure Date: June 09, 2023 (last updated October 08, 2023)
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
0
Attacker Value
Unknown
CVE-2021-36570
Disclosure Date: February 03, 2023 (last updated October 08, 2023)
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
0
Attacker Value
Unknown
CVE-2021-36569
Disclosure Date: February 03, 2023 (last updated October 08, 2023)
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
0
Attacker Value
Unknown
CVE-2021-44117
Disclosure Date: June 10, 2022 (last updated October 07, 2023)
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
0
Attacker Value
Unknown
CVE-2022-28599
Disclosure Date: May 03, 2022 (last updated October 07, 2023)
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
0
