Vulnerabilities > Thedaylightstudio > Fuel CMS > 1.4.3
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-08-09 | CVE-2021-38290 | Injection vulnerability in Thedaylightstudio Fuel CMS A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. | 6.8 |
| 2020-11-04 | CVE-2020-26167 | Information Exposure vulnerability in Thedaylightstudio Fuel CMS In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. | 10.0 |
| 2019-08-20 | CVE-2019-15229 | Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. | 6.8 |
| 2019-08-20 | CVE-2019-15228 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. | 3.5 |
| 2018-12-17 | CVE-2018-20188 | Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS 1.4.3 FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. | 6.8 |
| 2018-12-13 | CVE-2018-20137 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS 1.4.3 XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | 3.5 |
| 2018-12-13 | CVE-2018-20136 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS 1.4.3 XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. | 3.5 |