Login Request a demo
FC
Product
Fuel Cms
by Thedaylightstudio · last CVE Apr 16, 2026
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities40In the news0Timeline
Severity mix
Critical 11High 15Medium 14Low 0
Severity
All severities40Critical11High15Medium14Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Fuel Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-30460
8.8
1%
Apr 7
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module
Affected: 1.5.2
CVE-2020-24950
8.8
1%
Aug 11
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to…
Affected: 1.4.9
CVE-2023-33557
8.8
1%
Jun 9
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php
Affected: 1.5.2
CVE-2021-36570
8.8
1%
Feb 3
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---
Affected: 1.4.13
CVE-2021-36569
8.8
0%
Feb 3
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2
Affected: 1.4.13
CVE-2021-44117
8.8
1%
Jun 10
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4
Affected: 1.5.0
CVE-2021-38723
8.8
1%
Sep 9
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
Affected: 1.5.0
CVE-2020-23722
8.8
1%
Mar 10
An issue was discovered in FUEL CMS 1.4.7
Affected: 1.4.7
CVE-2019-15229
8.8
1%
Aug 20
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console
Affected: through 1.4.4
CVE-2018-20188
8.8
1%
Dec 17
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account
Affected: 1.4.3
CVE-2018-16416
8.8
1%
Sep 3
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password
Affected: 1.4
CVE-2026-30461
8.3
1%
Apr 15
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function…
Affected: 1.5.2
CVE-2021-38290
8.1
1%
Aug 9
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php
Affected: through 1.5.0
CVE-2026-30463
7.7
0%
Mar 26
Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component
Affected: 1.5.2
CVE-2026-30459
7.1
0%
Apr 16
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link…
Affected: 1.5.2
Showing 15