332 matches found
CVE-2020-26046
CVE-2020-26046 affects FUEL CMS 1.4.11. A stored cross-site scripting vulnerability exists in the Blocks/Navigation/Site variables, exploitable by an authenticated user and potentially impacting other visitors. Reported impact includes cookie stealing and other malicious actions. The available do...
CVE-2020-26045
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...
CVE-2020-26045
CVE-2020-26045 affects FUEL CMS 1.4.11 via SQL injection in the name parameter of /fuel/permissions/create/. Exploitation could compromise the application and allow data access/modification per the cited sources. The connected documents confirm the vulnerability but do not provide a concrete reme...
FUEL CMS SQL注入漏洞
FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.11 suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker via the 'name' parameter in /fuel/permissions/create/ to compromise an application, access or modify data, or exploit a...
FUEL CMS 1.4.8 suffers from SQL Injection Vulnerability
FUELCMS is a CMS system based on the Codeigniter framework. FUEL CMS 1.4.8 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...
VulnCheck KEV: CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
Fuel CMS 1.4 Remote Code Execution
!/usr/bin/env ruby Title: Fuel CMS 1.4 - Remote Code Execution Exploit Author: Alexandre ZANNI Date: 2020-11-14 Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 Version: FILE -h | --help Options: Root URL base path including...
CVE-2020-26167
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...
CVE-2020-26167
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...
Design/Logic Flaw
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...
CVE-2020-26167
Summary: CVE-2020-26167 affects FUEL CMS up to version 11.4.12. The vulnerability arises in the page preview feature, enabling an anonymous user to take complete ownership of any account, including administrator ones. This is described consistently across multiple sources (NVD entry and Red Hat a...
CVE-2020-26167
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...
Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)
Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...
Fuel CMS 1.4.8 SQL Injection
Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...
CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
Sql injection
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
CVE-2020-17463
Summary: CVE-2020-17463 affects Fuel CMS 1.4.7 and enables SQL Injection via the col parameter in /pages/items, /permissions/items, or /navigation/items. The underlying issue is a CWE-89-style vulnerable input handling that allows untrusted input to affect SQL queries. Impact in sources: high, in...
