Vulnerabilities > Thedaylightstudio > Fuel CMS > 1.0

DATE CVE VULNERABILITY TITLE RISK
2021-08-09 CVE-2021-38290 Injection vulnerability in Thedaylightstudio Fuel CMS
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php.
6.8
2020-11-04 CVE-2020-26167 Information Exposure vulnerability in Thedaylightstudio Fuel CMS
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
network
low complexity
thedaylightstudio CWE-200
critical
10.0
2019-08-20 CVE-2019-15229 Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console.
6.8
2019-08-20 CVE-2019-15228 Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console.
3.5
2018-09-09 CVE-2018-16763 Injection vulnerability in Thedaylightstudio Fuel CMS
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.
network
low complexity
thedaylightstudio CWE-74
7.5
2018-09-09 CVE-2018-16762 SQL Injection vulnerability in Thedaylightstudio Fuel CMS
FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.
network
low complexity
thedaylightstudio CWE-89
7.5