Vulnerabilities > Thedaylightstudio > Fuel CMS
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-01-05 | CVE-2020-26046 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS 1.4.11 FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. | 4.3 |
| 2021-01-05 | CVE-2020-26045 | SQL Injection vulnerability in Thedaylightstudio Fuel CMS 1.4.11 FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. | 7.5 |
| 2020-11-04 | CVE-2020-26167 | Information Exposure vulnerability in Thedaylightstudio Fuel CMS In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. | 10.0 |
| 2020-08-13 | CVE-2020-17463 | SQL Injection vulnerability in Thedaylightstudio Fuel CMS 1.4.7 FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. | 9.8 |
| 2019-08-20 | CVE-2019-15229 | Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. | 6.8 |
| 2019-08-20 | CVE-2019-15228 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. | 3.5 |
| 2018-12-17 | CVE-2018-20188 | Cross-Site Request Forgery (CSRF) vulnerability in Thedaylightstudio Fuel CMS 1.4.3 FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. | 6.8 |
| 2018-12-13 | CVE-2018-20137 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS 1.4.3 XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | 3.5 |
| 2018-12-13 | CVE-2018-20136 | Cross-site Scripting vulnerability in Thedaylightstudio Fuel CMS 1.4.3 XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. | 3.5 |
| 2018-09-09 | CVE-2018-16763 | Injection vulnerability in Thedaylightstudio Fuel CMS FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. | 7.5 |