CVE-2020-26046
MEDIUMFUEL CMS 1.4.11 - Authenticated Stored Cross-Site Scripting in Blocks/Navigation/Site Variables
Title source: llmDescription
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.
References (2)
Core 2
Core References
Product x_refsource_misc
https://getfuelcms.com
Exploit, Third Party Advisory x_refsource_misc
https://github.com/daylightstudio/FUEL-CMS/issues/574
Scores
CVSS v3
5.4
EPSS
0.0065
EPSS Percentile
47.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
thedaylightstudio/fuel_cms
1.4.11
Published
Jan 05, 2021
Tracked Since
Feb 18, 2026