Skip to content
Noroxi

thedaylightstudio records

40 published records for vendor thedaylightstudio.

Researcher profile

Entered KEV
1 · 2.5%
Weaponized
1 · 2.5%
Pre-auth RCE
7
With a fix record
2.5%
Median publish → KEV
484 days

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

40 records
  • CVE-2020-17463
    96Now

    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    thedaylightstudio · fuel cmsAug 13, 2020

  • CVE-2018-16763
    64This week

    FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    thedaylightstudio · fuel cmsSep 9, 2018

  • CVE-2020-26167
    40Plan

    In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an adm

    CriticalCVSS 9.8No exploitEPSS 3%

    thedaylightstudio · fuel cmsNov 4, 2020

  • CVE-2020-24791
    40Plan

    FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1.

    CriticalCVSS 9.8No exploitEPSS 3%

    thedaylightstudio · fuel cmsMar 10, 2021

  • CVE-2020-26045
    40Plan

    FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/.

    CriticalCVSS 9.8No exploitEPSS 2%

    thedaylightstudio · fuel cmsJan 5, 2021

  • CVE-2021-38727
    39Monitor

    FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items

    CriticalCVSS 9.8No exploitEPSS 2%

    thedaylightstudio · fuel cmsSep 9, 2021

  • CVE-2020-22153
    39Monitor

    File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload param

    CriticalCVSS 9.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsJul 3, 2023

  • CVE-2020-22151
    39Monitor

    Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests param

    CriticalCVSS 9.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsJul 3, 2023

  • CVE-2018-16762
    39Monitor

    FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.

    CriticalCVSS 9.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsSep 9, 2018

  • CVE-2026-30457
    39Monitor

    An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

    CriticalCVSS 9.8No exploitEPSS 1%

    thedaylightstudio · dwooMar 26, 2026

  • CVE-2026-30458
    36Monitor

    An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

    CriticalCVSS 9.1No exploitEPSS 0%

    thedaylightstudio · fuel cmsMar 26, 2026

  • CVE-2020-24950
    35Monitor

    SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbi

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsAug 11, 2023

  • CVE-2021-44117
    35Monitor

    A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4

    HighCVSS 8.8Proof of conceptEPSS 1%

    thedaylightstudio · fuel cmsJun 10, 2022

  • CVE-2021-38723
    35Monitor

    FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsSep 9, 2021

  • CVE-2020-23722
    35Monitor

    An issue was discovered in FUEL CMS 1.4.7.

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsMar 10, 2021

  • CVE-2026-30460
    35Monitor

    Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsApr 7, 2026

  • CVE-2018-16416
    35Monitor

    Cross-site request forgery (CSRF) vulnerability in my_profile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrat

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsSep 3, 2018

  • CVE-2023-33557
    35Monitor

    Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsJun 9, 2023

  • CVE-2021-36570
    35Monitor

    Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsFeb 3, 2023

  • CVE-2019-15229
    35Monitor

    FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console.

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsAug 19, 2019

  • CVE-2018-20188
    35Monitor

    FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.

    HighCVSS 8.8No exploitEPSS 1%

    thedaylightstudio · fuel cmsDec 17, 2018

  • CVE-2021-36569
    35Monitor

    Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.

    HighCVSS 8.8No exploitEPSS 0%

    thedaylightstudio · fuel cmsFeb 3, 2023

  • CVE-2026-30461
    33Monitor

    Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Ins

    HighCVSS 8.3No exploitEPSS 1%

    thedaylightstudio · fuel cmsApr 15, 2026

  • CVE-2021-38290
    32Monitor

    A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/librar

    HighCVSS 8.1No exploitEPSS 1%

    thedaylightstudio · fuel cmsAug 9, 2021

  • CVE-2026-30463
    30Monitor

    Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

    HighCVSS 7.7No exploitEPSS 0%

    thedaylightstudio · fuel cmsMar 26, 2026