Login Request a demo
TH
Vendor
Thedaylightstudio
2 products with CVEs on record
41
CVEs
1
On KEV
0
New 30D
Products
FC
Fuel Cms
Thedaylightstudio
9.8
40 CVEs1 on KEV0 new
DW
Dwoo
Thedaylightstudio
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-30459
FC
Fuel Cms
Thedaylightstudio
7.1
0%
Apr 16An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link…
CVE-2026-30461
FC
Fuel Cms
Thedaylightstudio
8.3
1%
Apr 15Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function…
CVE-2026-30460
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Apr 7Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module
CVE-2026-30463
FC
Fuel Cms
Thedaylightstudio
7.7
0%
Mar 26Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component
CVE-2026-30458
FC
Fuel Cms
Thedaylightstudio
9.1
0%
Mar 26An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack
CVE-2026-30457
DW
Dwoo
Thedaylightstudio
9.8
1%
Mar 26An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code
CVE-2024-57605
FC
Fuel Cms
Thedaylightstudio
5.4
0%
Feb 12Cross Site Scripting vulnerability in Daylight Studio Fuel CMS v.1.5.2 allows an attacker to escalate privileges via the /fuel/blocks/ and /fuel/pages components
CVE-2024-25369
FC
Fuel Cms
Thedaylightstudio
5.4
0%
Feb 22A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter
CVE-2020-24950
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Aug 11SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to…
CVE-2020-22151
FC
Fuel Cms
Thedaylightstudio
9.8
1%
Jul 3Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function
CVE-2020-22153
FC
Fuel Cms
Thedaylightstudio
9.8
1%
Jul 3File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function
CVE-2020-22152
FC
Fuel Cms
Thedaylightstudio
5.4
1%
Jul 3Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords…
CVE-2023-33557
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Jun 9Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php
CVE-2021-36570
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Feb 3Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---
CVE-2021-36569
FC
Fuel Cms
Thedaylightstudio
8.8
0%
Feb 3Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2
CVE-2021-44117
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Jun 10A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4
CVE-2022-28599
FC
Fuel Cms
Thedaylightstudio
5.4
1%
May 3A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload
CVE-2022-27156
FC
Fuel Cms
Thedaylightstudio
5.4
0%
Apr 11Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection
CVE-2021-44607
FC
Fuel Cms
Thedaylightstudio
5.4
0%
Feb 23A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file
CVE-2021-38727
FC
Fuel Cms
Thedaylightstudio
9.8
2%
Sep 9FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
CVE-2021-38721
FC
Fuel Cms
Thedaylightstudio
6.5
1%
Sep 9FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
CVE-2021-38723
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Sep 9FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
CVE-2021-38725
FC
Fuel Cms
Thedaylightstudio
5.3
1%
Sep 9Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
CVE-2021-38290
FC
Fuel Cms
Thedaylightstudio
8.1
1%
Aug 9A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php
CVE-2020-28705
FC
Fuel Cms
Thedaylightstudio
4.3
1%
Mar 10FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3
CVE-2020-24791
FC
Fuel Cms
Thedaylightstudio
9.8
3%
Mar 10FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1
CVE-2020-23722
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Mar 10An issue was discovered in FUEL CMS 1.4.7
CVE-2020-23721
FC
Fuel Cms
Thedaylightstudio
5.4
1%
Mar 10An issue was discovered in FUEL CMS V1.4.7
CVE-2020-26046
FC
Fuel Cms
Thedaylightstudio
5.4
1%
Jan 5FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables
CVE-2020-26045
FC
Fuel Cms
Thedaylightstudio
9.8
2%
Jan 5FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/
CVE-2020-26167
FC
Fuel Cms
Thedaylightstudio
9.8
3%
Nov 4In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one
CVE-2020-17463
In wildKEV
FC
Fuel Cms
Thedaylightstudio
9.8
90%
Aug 13Fuel CMS SQL Injection Vulnerability
CVE-2019-15229
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Aug 20FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console
CVE-2019-15228
FC
Fuel Cms
Thedaylightstudio
5.4
1%
Aug 20FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console
CVE-2018-20188
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Dec 17FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account
CVE-2018-20137
FC
Fuel Cms
Thedaylightstudio
4.8
1%
Dec 13XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI
CVE-2018-20136
FC
Fuel Cms
Thedaylightstudio
4.8
1%
Dec 13XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI
CVE-2018-16763
FC
Fuel Cms
Thedaylightstudio
9.8
83%
Sep 9FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter
CVE-2018-16762
FC
Fuel Cms
Thedaylightstudio
9.8
1%
Sep 9FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items
CVE-2018-16416
FC
Fuel Cms
Thedaylightstudio
8.8
1%
Sep 3Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password