CVE-2020-26045

FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-26045

CVE-2020-26045 affects FUEL CMS 1.4.11 via SQL injection in the name parameter of /fuel/permissions/create/. Exploitation could compromise the application and allow data access/modification per the cited sources. The connected documents confirm the vulnerability but do not provide a concrete reme...

CVE-2020-26045

FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.11 suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker via the 'name' parameter in /fuel/permissions/create/ to compromise an application, access or modify data, or exploit a...

PT-2021-11207

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.11 Description: The issue allows SQL Injection via the name parameter in the "/fuel/permissions/create/" endpoint. This could enable an attacker to compromise the application, access or modify data, or exploit latent...

CVE-2020-26045: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-26046: Improper Neutralization of Input During Web Page Generation

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors...

PT-2021-11208

Name of the Vulnerable Software and Affected Versions: FUEL CMS version 1.4.11 Description: The issue is related to stored XSS in Blocks/Navigation/Site variables, which could lead to cookie stealing and other malicious actions. This can be exploited with an authenticated account and also impact...

FUEL CMS 1.4.8 suffers from SQL Injection Vulnerability

FUELCMS is a CMS system based on the Codeigniter framework. FUEL CMS 1.4.8 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

VulnCheck KEV: CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

Fuel CMS 1.4 Remote Code Execution

!/usr/bin/env ruby Title: Fuel CMS 1.4 - Remote Code Execution Exploit Author: Alexandre ZANNI Date: 2020-11-14 Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1 Version: FILE -h | --help Options: Root URL base path including...

CVE-2020-26167

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

CVE-2020-26167

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

Design/Logic Flaw

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

CVE-2020-26167

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

CVE-2020-26167

Summary: CVE-2020-26167 affects FUEL CMS up to version 11.4.12. The vulnerability arises in the page preview feature, enabling an anonymous user to take complete ownership of any account, including administrator ones. This is described consistently across multiple sources (NVD entry and Red Hat a...

CVE-2020-26167: Undefined Security Weakness

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

PT-2020-16324

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 11.4.12 and earlier Description The page preview feature in FUEL CMS allows an anonymous user to take complete ownership of any account, including an administrator account. Recommendations For versions 11.4.12 and earlier, as...

Fuel CMS 1.4.8 SQL Injection

Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...

Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)

Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...