CVE-2018-20137

XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...

FUEL CMS SQL Injection Vulnerability

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.1 suffers from a SQL injection vulnerability that can be exploited by an attacker via the layout, published or searchterm parameters of pages/items...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

Sql injection

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

Remote code execution

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

Summary (CVE-2018-16763) : Fuel CMS version 1.4.1 is vulnerable to a pre-auth Remote Code Execution via PHP code evaluation. The flaw is triggered through unsafe handling of user-controlled data in the pages/select/ filter parameter or the preview/ data parameter, allowing arbitrary PHP execution...

CVE-2018-16762

CVE-2018-16762 affects FUEL CMS 1.4.1 and allows SQL Injection via the layout, published, or search_term parameters of pages/items. The root cause is improper input handling that enables crafted input to alter SQL queries. Documented impact includes high/severe CVSS metrics (e.g., CVSS v3 base sc...

PT-2018-13726 · Fuel Cms · Fuel Cms

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.1 Description: The issue allows for PHP code evaluation, potentially leading to pre-authentication remote code execution. This can be achieved via the filter parameter in the "pages/select/" endpoint or the data parameter...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Recent assessments: noraj at May 08, 2021 7:33pm UTC reported: Unauthenticated RCE with default config, this is critical. Assessed...

FUEL CMS Cross-Site Request Forgery Vulnerability

FUEL CMS is a content management system based on CodeIgniter. A cross-site request forgery vulnerability exists in myprofile/edit?inline= in FUEL CMS 1.4, which can be exploited by remote attackers to change the administrator password...

CVE-2018-16416

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

CVE-2018-16416

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

CVE-2018-16416

The CVE-2018-16416 issue affects FUEL CMS 1.4, specifically a Cross-Site Request Forgery flaw in the my_profile/edit?inline= path. The underlying problem is CSRF that lets an attacker remotely change the administrator password. Connected records (Red Hat, CNVD, OSV, CVE lists) corroborate the sam...