1.0.4

DATE	CVE	VULNERABILITY TITLE	RISK
2021-08-09	CVE-2021-38290	Injection vulnerability in Thedaylightstudio Fuel CMS A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. network high complexity thedaylightstudio CWE-74	8.1
2020-11-04	CVE-2020-26167	Unspecified vulnerability in Thedaylightstudio Fuel CMS In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. network low complexity thedaylightstudio critical	9.8
2019-08-20	CVE-2019-15229	Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. network low complexity thedaylightstudio CWE-352	8.8
2019-08-20	CVE-2019-15228	Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. network low complexity thedaylightstudio CWE-79	5.4
2018-09-09	CVE-2018-16763	Injection vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. network low complexity thedaylightstudio CWE-74 critical	9.8
2018-09-09	CVE-2018-16762	SQL Injection vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items. network low complexity thedaylightstudio CWE-89 critical	9.8