Thedaylightstudio Fuel Cms vulnerabilities

CVE-2021-44117 [HIGH] CWE-352 CVE-2021-44117: A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a P A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.

CVE-2021-36570 [HIGH] CWE-352 CVE-2021-36570: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.

CVE-2021-36569 [HIGH] CWE-352 CVE-2021-36569: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.

CVE-2018-16416 [HIGH] CWE-352 CVE-2018-16416: Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows re Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.

CVE-2026-30459 [HIGH] CWE-640 CVE-2026-30459: An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated att An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

CVE-2018-20188 [HIGH] CWE-352 CVE-2018-20188: FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.

CVE-2021-38721 [MEDIUM] CWE-352 CVE-2021-38721: FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability

CVE-2022-28599 [MEDIUM] CWE-79 CVE-2022-28599: A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authentica A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.

CVE-2022-27156 [MEDIUM] CWE-79 CVE-2022-27156: Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection. Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.

CVE-2019-15228 [MEDIUM] CWE-79 CVE-2019-15228: FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.

CVE-2020-26046 [MEDIUM] CWE-79 CVE-2020-26046: FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie steali FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.

CVE-2021-38725 [MEDIUM] CWE-307 CVE-2021-38725: Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php

CVE-2020-23721 [MEDIUM] CWE-79 CVE-2020-23721: An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter vi An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.

CVE-2024-57605 [MEDIUM] CWE-79 CVE-2024-57605: Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalat Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.

CVE-2021-44607 [MEDIUM] CWE-79 CVE-2021-44607: A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG fi A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.

CVE-2024-25369 [MEDIUM] CWE-79 CVE-2024-25369: A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitr A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.

CVE-2020-22152 [MEDIUM] CWE-79 CVE-2020-22152: Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.

CVE-2018-20137 [MEDIUM] CWE-79 CVE-2018-20137: XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.

CVE-2018-20136 [MEDIUM] CWE-79 CVE-2018-20136: XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.

CVE-2020-28705 [MEDIUM] CWE-352 CVE-2020-28705: FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page vi FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.