Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (34 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-17463 1 Thedaylightstudio 1 Fuel Cms 2025-07-30 9.8 Critical
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2024-57605 1 Thedaylightstudio 1 Fuel Cms 2025-07-09 5.4 Medium
Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.
CVE-2020-26167 1 Thedaylightstudio 1 Fuel Cms 2025-05-30 9.8 Critical
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
CVE-2024-25369 1 Thedaylightstudio 1 Fuel Cms 2025-04-03 6.1 Medium
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.
CVE-2021-36570 1 Thedaylightstudio 1 Fuel Cms 2025-03-26 8.8 High
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVE-2021-36569 1 Thedaylightstudio 1 Fuel Cms 2025-03-26 8.8 High
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVE-2023-33557 1 Thedaylightstudio 1 Fuel Cms 2025-01-06 8.8 High
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
CVE-2020-22151 1 Thedaylightstudio 1 Fuel Cms 2024-11-25 9.8 Critical
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
CVE-2020-22152 1 Thedaylightstudio 1 Fuel Cms 2024-11-22 5.4 Medium
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
CVE-2020-22153 1 Thedaylightstudio 1 Fuel Cms 2024-11-22 9.8 Critical
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
CVE-2022-28599 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
CVE-2022-27156 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.4 Medium
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
CVE-2021-44607 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
CVE-2021-44117 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 8.8 High
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
CVE-2021-38727 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 9.8 Critical
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
CVE-2021-38725 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.3 Medium
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
CVE-2021-38723 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 8.8 High
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
CVE-2021-38721 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 6.5 Medium
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
CVE-2021-38290 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 8.1 High
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
CVE-2020-28705 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 4.3 Medium
FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.