CVE-2026-30459

概要

参考情報

• daylightstudio/FUEL-CMS · Product
• pentest-tools.com/PTT-2025-029-Password-Reset-Poisoning-via-Host-Header.pdf · Exploit

fuel cms のその他の脆弱性

• CVE-2026-30461高 8.3Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Ins…
• CVE-2026-30460高 8.8Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
• CVE-2026-30463高 7.7Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
• CVE-2026-30458緊急 9.1An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
• CVE-2026-30457緊急 9.8An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.