Login Request a demo
FC
Product
Fuel Cms
by Thedaylightstudio · last CVE Apr 16, 2026
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities40In the news0Timeline
Severity mix
Critical 11High 15Medium 14Low 0
Severity
All severities40Critical11High15Medium14Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Fuel Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-38721
6.5
1%
Sep 9
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
Affected: 1.5.0
CVE-2024-57605
5.4
0%
Feb 12
Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components
Affected: 1.5.2
CVE-2024-25369
5.4
0%
Feb 22
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter
Affected: 1.5.2
CVE-2020-22152
5.4
1%
Jul 3
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords…
Affected: 1.4.6
CVE-2022-28599
5.4
1%
May 3
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload
Affected: 1.5.1
CVE-2022-27156
5.4
0%
Apr 11
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection
Affected: 1.5.1
CVE-2021-44607
5.4
0%
Feb 23
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file
Affected: 1.5.1
CVE-2020-23721
5.4
1%
Mar 10
An issue was discovered in FUEL CMS V1.4.7
Affected: 1.4.7
CVE-2020-26046
5.4
1%
Jan 5
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables
Affected: 1.4.11
CVE-2019-15228
5.4
1%
Aug 20
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console
Affected: through 1.4.4
CVE-2021-38725
5.3
1%
Sep 9
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
Affected: 1.5.0
CVE-2018-20137
4.8
1%
Dec 13
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI
Affected: 1.4.3
CVE-2018-20136
4.8
1%
Dec 13
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI
Affected: 1.4.3
CVE-2020-28705
4.3
1%
Mar 10
FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3
Affected: 1.4.13
Showing 14