Vulnerabilidades de Thedaylightstudio
CVEs publicadas que afetam produtos de Thedaylightstudio: 7 registro(s), com severidade, exploração e correções.
CVE-2026-30459
Alta · 7.1
CWE-640 16/04/2026
Weak Password Recovery Mechanism em Thedaylightstudio Fuel Cms
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
CVE-2026-30461
Alta · 8.3
CWE-77 15/04/2026
Command Injection em Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
CVE-2026-30460
Alta · 8.8
CWE-94 07/04/2026
Code Injection em Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
CVE-2026-30463
Alta · 7.7
CWE-89 26/03/2026
SQL Injection em Thedaylightstudio Fuel Cms
Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.
CVE-2026-30458
Crítica · 9.1
CWE-620 26/03/2026
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users'…
An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.
CVE-2026-30457
Crítica · 9.8
CWE-94 26/03/2026
Code Injection em Thedaylightstudio Dwoo
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
CVE-2020-17463
Crítica · 9.8
KEV Alta · 67 Exploit público CWE-89 13/08/2020
Fuel CMS SQL Injection Vulnerability
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.