Exploit Database
147,629 exploits tracked across all sources.
FUEL CMS 1.5.0 - SQL Injection via 'col' Parameter
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
CVSS 8.8
FUEL CMS 1.5.0 - Cross-Site Request Forgery in login.php
FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
CVSS 6.5
FUEL CMS < 1.5.0 - Host Header Injection
A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
CVSS 8.1
FUEL-CMS 1.4.13 - Cross-Site Request Forgery via Permissions Delete Endpoint
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVSS 8.8
FUEL-CMS 1.4.13 - Cross-Site Request Forgery via User Deletion Endpoint
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVSS 8.8
FUEL CMS 1.4.13 - Cross-Site Request Forgery via Page Deletion Endpoint
FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
CVSS 4.3
FUEL CMS 1.4.11 - Authenticated Stored Cross-Site Scripting in Blocks/Navigation/Site Variables
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.
CVSS 5.4
FUEL CMS 1.4.11 - SQL Injection via Name Parameter in Permissions Create Endpoint
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL CMS 1.4.11 - SQL Injection via Name Parameter in Permissions Create Endpoint
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL-CMS 1.4.9 - SQL Injection via Base_module_model.php col Parameter
SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.
CVSS 8.8
FUEL CMS 1.4.8 - SQL Injection via fuel_replace_id Parameter
FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS 9.8
FUEL CMS <1.4.7 - Privilege Escalation
An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters.
CVSS 8.8
FUEL CMS 1.4.7 - Stored Cross-Site Scripting via Pages Edit Endpoint
An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.
CVSS 5.4
FUEL-CMS 1.4.6 - Remote Code Execution via Navigation Upload Parameter
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
CVSS 9.8
FUEL CMS 1.4.6 - Stored Cross-Site Scripting via Page Metadata Fields
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
CVSS 5.4
Fuel-CMS 1.4.6 - Unauthenticated Arbitrary Code Execution via Zip File Upload
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
CVSS 9.8
FUEL CMS 1.4.7 - SQL Injection via col Parameter
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVSS 9.8
FUEL CMS < 1.4.4 - Cross-Site Request Forgery in Admin Console Blocks Creation
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
CVSS 8.8
FUEL CMS < 1.4.4 - Cross-Site Scripting in Create Blocks Section
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
CVSS 5.4
FUEL CMS < 1.4.2 - Unauthenticated Remote Code Execution via Pages Filter or Preview Data Parameter
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.
CVSS 9.8
FUEL CMS < 1.4.2 - SQL Injection via layout, published, or search_term parameter
FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.
CVSS 9.8
FUEL CMS 1.4 - Cross-Site Request Forgery in my_profile/edit Endpoint
Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password.
CVSS 8.8
FuelCMS 1.5.2 - Unauthenticated Account Takeover via Password Reset Token Exfiltration
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
CVSS 9.1
Daylight Studio FuelCMS - Remote Code Execution via Dwoo Parser
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
CVSS 9.8
Infinite loop in github.com/antchfx/xpath
Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true()".
CVSS 7.5
By Source