Most severe vulnerabilities for "thedaylightstudio fuel cms" 1.5.2

Where

AND

Sort:

Daylight Studio FuelCMSCode Injection

Risk 86

Severity

9.8

Code Injection

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

First published (updated )

CVE-2026-30457

Daylight Studio FuelCMSAn issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset toke…

Risk 66

Severity

9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

First published (updated )

CVE-2026-30458

TheDayLightStudio Fuel CMSCode Injection

Risk 79

Severity

8.8

Code Injection

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.

First published (updated )

CVE-2026-30460

TheDayLightStudio Fuel CMSSQL Injection

Risk 79

Severity

8.8

SQL Injection

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.

First published (updated )

CVE-2023-33557

Daylight Studio FuelCMSCommand Injection

Risk 69

Severity

8.3

Command Injection

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function addgitsubmodule.

First published (updated )

CVE-2026-30461

Daylight Studio FuelCMSSQL Injection

Risk 66

Severity

7.7

SQL Injection

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

First published (updated )

CVE-2026-30463

Daylight Studio FuelCMSAn issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated att…

Risk 47

Severity

7.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

First published (updated )

CVE-2026-30459

Fuel CMS Fuel CMSXSS

Risk 25

Severity

5.4

EPSS

0.04%

XSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the groupid parameter.

First published (updated )

CVE-2024-25369

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

Company

Resources

Contact