CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/08/2021 |
| CVE-2020-28705 | 보통4.3 | FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. | 10/03/2021 |
| CVE-2020-24791 | 심각9.8 | FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | 10/03/2021 |
| CVE-2020-23722 | 높음8.8 | An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters. | 10/03/2021 |
| CVE-2020-23721 | 보통5.4 | An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english. | 10/03/2021 |
| CVE-2020-26046 | 보통5.4 | FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors. | 05/01/2021 |
| CVE-2020-26045 | 심각9.8 | FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | 05/01/2021 |
| CVE-2020-26167 | 심각9.8 | In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. | 04/11/2020 |
| CVE-2020-17463KEV | 심각9.8 | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. | 13/08/2020 |
| CVE-2019-15229 | 높음8.8 | FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page. | 20/08/2019 |
| CVE-2019-15228 | 보통5.4 | FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors. | 20/08/2019 |
| CVE-2018-20188 | 높음8.8 | FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account. | 17/12/2018 |
| CVE-2018-20137 | 보통4.8 | XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI. | 13/12/2018 |
| CVE-2018-20136 | 보통4.8 | XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI. | 13/12/2018 |
| CVE-2018-16763 | 심각9.8 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. | 09/09/2018 |
| CVE-2018-16762 | 심각9.8 | FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items. | 09/09/2018 |
| CVE-2018-16416 | 높음8.8 | Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password. | 03/09/2018 |