Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how daylight studio compares to other vendors in security performance

View Risk Score →

Daylight Studio FuelCMSCode Injection

Risk 86
Severity
9.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

First published (updated )
CVE-2026-30457

Daylight Studio FuelCMSAn issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset toke…

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

First published (updated )
CVE-2026-30458

Daylight Studio FuelCMSCommand Injection

Risk 69
Severity
8.3
Command Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function addgitsubmodule.

First published (updated )
CVE-2026-30461

Daylight Studio FuelCMSSQL Injection

Risk 66
Severity
7.7
SQL Injection
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

First published (updated )
CVE-2026-30463

Daylight Studio FuelCMSAn issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated att…

Risk 47
Severity
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

First published (updated )
CVE-2026-30459

Daylight Studio Fuel CMSXSS

Risk 34
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components.

First published (updated )
CVE-2024-57605

Daylight Studio FuelCMSPath Traversal

Risk 22
Severity
4.3
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.

First published (updated )
CVE-2026-30462

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203