Thedaylightstudio
Thedaylightstudio Fuel CMS: vulnerabilidades y CVE
Thedaylightstudio Fuel CMS tiene 42 vulnerabilidades publicadas, 8 de ellas en los últimos 12 meses. 11 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE42
Últimos 12 meses8
Críticas11
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-17463 | Crítica (9.8) | 90% | ⚠ Explotación activa | 13 ago 2020 | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-47980 | Alta (7.1) | 0.23% | — | 16 may 2026 | Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers… |
| CVE-2026-38948 | Media (5.4) | 0.29% | — | 28 abr 2026 | Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize uploaded SVG files, allowing a low-privileged authenticated… |
| CVE-2026-30459 | Alta (7.1) | 0.32% | — | 16 abr 2026 | An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message. |
| CVE-2026-30461 | Alta (8.3) | 0.73% | — | 15 abr 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule. |
| CVE-2026-30460 | Alta (8.8) | 0.90% | — | 7 abr 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module. |
| CVE-2026-30463 | Alta (7.7) | 0.34% | — | 26 mar 2026 | Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component. |
| CVE-2026-30458 | Crítica (9.1) | 0.44% | — | 26 mar 2026 | An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack. |
| CVE-2026-30457 | Crítica (9.8) | 0.78% | — | 26 mar 2026 | An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code. |
| CVE-2024-57605 | Media (5.4) | 0.33% | — | 12 feb 2025 | Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components. |
| CVE-2024-25369 | Media (5.4) | 0.38% | — | 22 feb 2024 | A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. |
| CVE-2020-24950 | Alta (8.8) | 1.4% | — | 11 ago 2023 | SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items. |
| CVE-2020-22153 | Crítica (9.8) | 1.5% | — | 3 jul 2023 | File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function. |
| CVE-2020-22152 | Media (5.4) | 0.58% | — | 3 jul 2023 | Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function. |
| CVE-2020-22151 | Crítica (9.8) | 1.5% | — | 3 jul 2023 | Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function. |
| CVE-2023-33557 | Alta (8.8) | 0.80% | — | 9 jun 2023 | Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php. |
| CVE-2021-36570 | Alta (8.8) | 0.73% | — | 3 feb 2023 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. |
| CVE-2021-36569 | Alta (8.8) | 0.43% | — | 3 feb 2023 | Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2. |
| CVE-2021-44117 | Alta (8.8) | 1.4% | — | 10 jun 2022 | A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4. |
| CVE-2022-28599 | Media (5.4) | 0.57% | — | 3 may 2022 | A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by… |
| CVE-2022-27156 | Media (5.4) | 0.49% | — | 11 abr 2022 | Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection. |
| CVE-2021-44607 | Media (5.4) | 0.49% | — | 24 feb 2022 | A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file. |
| CVE-2021-38727 | Crítica (9.8) | 1.6% | — | 9 sept 2021 | FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items |
| CVE-2021-38725 | Media (5.3) | 0.88% | — | 9 sept 2021 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php |
| CVE-2021-38723 | Alta (8.8) | 1.0% | — | 9 sept 2021 | FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items |
| CVE-2021-38721 | Media (6.5) | 0.60% | — | 9 sept 2021 | FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability |
| CVE-2021-38290 | Alta (8.1) | 1.3% | — | 9 ago 2021 | A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing. |
| CVE-2020-28705 | Media (4.3) | 0.58% | — | 10 mar 2021 | FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. |
| CVE-2020-24791 | Crítica (9.8) | 2.6% | — | 10 mar 2021 | FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent… |
| CVE-2020-23722 | Alta (8.8) | 1.0% | — | 10 mar 2021 | An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters. |
| CVE-2020-23721 | Media (5.4) | 0.58% | — | 10 mar 2021 | An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.