Medium severity · published Aug 20, 2019
CVE-2019-15228
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Fuel Cms · Thedaylightstudio
through 1.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15228
Exploit
https://github.com/daylightstudio/FUEL-CMS/issues/536
Exploit
https://www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xss
More from Fuel Cms
9.8
CVE-2020-17463
Fuel CMS SQL Injection Vulnerability
9.8
CVE-2026-30457
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code
9.8
CVE-2020-22153
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function
9.8
CVE-2020-22151
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function
9.8
CVE-2021-38727
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items