Exploit Database
147,561 exploits tracked across all sources.
staffwiki 7.0.1.19219 - Cross-Site Scripting via wff_cols_pref.css.aspx Endpoint
A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted HTTP request.
CVSS 6.1
Fuel CMS 1.5.2 - SQL Injection via Blocks Controller id Parameter
Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.
CVSS 8.8
FUEL-CMS 1.5.1 - Authenticated Stored Cross-Site Scripting via PDF Upload
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
CVSS 5.4
Fuel CMS 1.5.1 - HTML Injection
Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection.
CVSS 5.4
FUEL-CMS 1.5.1 - Stored Cross-Site Scripting via SVG File Upload
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
CVSS 5.4
FUEL CMS 1.5.0 - SQL Injection via 'col' Parameter in Logs Endpoint
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
CVSS 9.8
Fuel CMS 1.5.0 - Brute Force Attack via Login Controller
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
CVSS 5.3
FUEL CMS 1.5.0 - SQL Injection via 'col' Parameter
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
CVSS 8.8
FUEL CMS 1.5.0 - Cross-Site Request Forgery in login.php
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
CVSS 6.5
FUEL CMS < 1.5.0 - Host Header Injection
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
CVSS 8.1
FUEL-CMS 1.4.13 - Cross-Site Request Forgery via Permissions Delete Endpoint
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVSS 8.8
FUEL-CMS 1.4.13 - Cross-Site Request Forgery via User Deletion Endpoint
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVSS 8.8
FUEL CMS 1.4.13 - Cross-Site Request Forgery via Page Deletion Endpoint
FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
CVSS 4.3
FUEL CMS 1.4.11 - Authenticated Stored Cross-Site Scripting in Blocks/Navigation/Site Variables
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.
CVSS 5.4
FUEL CMS 1.4.11 - SQL Injection via Name Parameter in Permissions Create Endpoint
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL CMS 1.4.11 - SQL Injection via Name Parameter in Permissions Create Endpoint
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL-CMS 1.4.9 - SQL Injection via Base_module_model.php col Parameter
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
CVSS 8.8
FUEL CMS 1.4.8 - SQL Injection via fuel_replace_id Parameter
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL CMS <1.4.7 - Privilege Escalation
An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters.
CVSS 8.8
FUEL CMS 1.4.7 - Stored Cross-Site Scripting via Pages Edit Endpoint
An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.
CVSS 5.4
FUEL-CMS 1.4.6 - Remote Code Execution via Navigation Upload Parameter
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
CVSS 9.8
FUEL CMS 1.4.6 - Stored Cross-Site Scripting via Page Metadata Fields
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
CVSS 5.4
Fuel-CMS 1.4.6 - Unauthenticated Arbitrary Code Execution via Zip File Upload
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
CVSS 9.8
FUEL CMS 1.4.7 - SQL Injection via col Parameter
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVSS 9.8
FUEL CMS < 1.4.4 - Cross-Site Request Forgery in Admin Console Blocks Creation
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
CVSS 8.8
By Source