CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

Sql injection

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

Privilege escalation

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

Cross site request forgery (csrf)

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

Cross site scripting

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-28705

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

CVE-2020-28705

CVE-2020-28705 affects FUEL CMS 1.4.13. The vulnerability is a cross-site request forgery (CSRF) that allows an attacker to delete a page by sending a POST to /pages/delete/3. The connected records confirm the CVE description and impact (CSRF; delete page) but do not provide exploitation status o...

CVE-2020-28705

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

CVE-2020-24791

FUEL CMS 1.4.8 contains a SQL injection in the fuel_replace_id parameter of pages/replace/1. The root cause is an injection vector that allows an attacker to read/modify data and potentially exploit underlying database vulnerabilities. Impact is described as compromising the application and data ...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-23722

CVE-2020-23722 affects FUEL CMS 1.4.7 . The connected documents describe an elevation of privilege vulnerability that enables an attacker to obtain super administrator privileges via manipulation of the id and fuel_id parameters. No root cause, affected versions, or exploitation details are expli...

CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

CVE-2020-23721

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-23721

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-23721

FUEL CMS 1.4.7 contains a cross-site scripting (XSS) vulnerability in the page edit path. Specifically, an attacker can craft an XSS payload that bypasses the input filter via /fuelCM/fuel/pages/edit/1?lang=english, enabling script execution in affected sessions. Multiple trusted sources in the c...

CVE-2020-23721: Improper Neutralization of Input During Web Page Generation

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-28705: Cross-Site Request Forgery (CSRF)

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

PT-2021-10938

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4.7 Description An issue was discovered in FUEL CMS, where an attacker can use a XSS payload and bypass a filter via the "/fuelCM/fuel/pages/edit/1?lang=english" API endpoint. Recommendations For FUEL CMS version 1.4.7, as a...