Thedaylightstudio vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-30459 An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user vHigh 7.1 · Apr 16, 2026
• CVE-2026-30461 Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the fHigh 8.3 · Apr 15, 2026
• CVE-2026-30460 Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.High 8.8 · Apr 7, 2026
• CVE-2026-30463 Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.High 7.7 · Mar 26, 2026
• CVE-2026-30458 An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.Critical 9.1 · Mar 26, 2026
• CVE-2026-30457 An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.Critical 9.8 · Mar 26, 2026
• CVE-2020-24950 SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the cHigh 8.8 · Aug 11, 2023
• CVE-2020-22153 File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigatiCritical 9.8 · Jul 3, 2023
• CVE-2020-22151 Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload fCritical 9.8 · Jul 3, 2023
• CVE-2023-33557 Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.High 8.8 · Jun 9, 2023
• CVE-2021-36570 Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.High 8.8 · Feb 3, 2023
• CVE-2021-36569 Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.High 8.8 · Feb 3, 2023
• CVE-2021-44117 A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.High 8.8 · Jun 10, 2022
• CVE-2021-38727 FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/itemsCritical 9.8 · Sep 9, 2021
• CVE-2021-38723 FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/itemsHigh 8.8 · Sep 9, 2021
• CVE-2021-38290 A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php.High 8.1 · Aug 9, 2021
• CVE-2020-24791 FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1.Critical 9.8 · Mar 10, 2021
• CVE-2020-23722 An issue was discovered in FUEL CMS 1.4.7.High 8.8 · Mar 10, 2021
• CVE-2020-26045 FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/.Critical 9.8 · Jan 5, 2021
• CVE-2020-26167 In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.Critical 9.8 · Nov 4, 2020
• CVE-2019-15229 FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console.High 8.8 · Aug 19, 2019
• CVE-2018-20188 FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.High 8.8 · Dec 17, 2018
• CVE-2018-16763 FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.Critical 9.8 · Sep 9, 2018
• CVE-2018-16762 FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.Critical 9.8 · Sep 9, 2018
• CVE-2018-16416 Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.High 8.8 · Sep 3, 2018