Thedaylightstudio vulnerabilities
Published CVEs affecting Thedaylightstudio products: 7 record(s), with severity, exploitation and fixes.
CVE-2026-30459
High · 7.1
CWE-640 Apr 16, 2026
Weak Password Recovery Mechanism in Thedaylightstudio Fuel Cms
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
CVE-2026-30461
High · 8.3
CWE-77 Apr 15, 2026
Command Injection in Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
CVE-2026-30460
High · 8.8
CWE-94 Apr 7, 2026
Code Injection in Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
CVE-2026-30463
High · 7.7
CWE-89 Mar 26, 2026
SQL Injection in Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
CVE-2026-30458
Critical · 9.1
CWE-620 Mar 26, 2026
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users'…
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
CVE-2026-30457
Critical · 9.8
CWE-94 Mar 26, 2026
Code Injection in Thedaylightstudio Dwoo
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
CVE-2020-17463
Critical · 9.8
KEV High · 67 Public exploit CWE-89 Aug 13, 2020
Fuel CMS SQL Injection Vulnerability
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.