Login Request a demo
FC
Product
Fuel Cms
by Thedaylightstudio · last CVE Apr 16, 2026
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities40In the news0Timeline
Severity mix
Critical 11High 15Medium 14Low 0
Severity
All severities40Critical11High15Medium14Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Fuel Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-17463
In wildKEV
9.8
90%
Aug 13
Fuel CMS SQL Injection Vulnerability
Affected: 1.4.7
CVE-2026-30457
9.8
1%
Mar 26
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code
Affected: 1.5.2
CVE-2020-22153
9.8
1%
Jul 3
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function
Affected: 1.4.6
CVE-2020-22151
9.8
1%
Jul 3
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function
Affected: 1.4.6
CVE-2021-38727
9.8
2%
Sep 9
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
Affected: 1.5.0
CVE-2020-24791
9.8
3%
Mar 10
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1
Affected: 1.4.8
CVE-2020-26045
9.8
2%
Jan 5
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/
Affected: 1.4.11
CVE-2020-26167
9.8
3%
Nov 4
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one
Affected: through 1.4.12
CVE-2018-16763
9.8
83%
Sep 9
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter
Affected: through 1.4.2
CVE-2018-16762
9.8
1%
Sep 9
FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items
Affected: through 1.4.2
CVE-2026-30458
9.1
0%
Mar 26
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack
Affected: 1.5.2
Showing 11