CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

CVE-2018-16763

Summary (CVE-2018-16763) : Fuel CMS version 1.4.1 is vulnerable to a pre-auth Remote Code Execution via PHP code evaluation. The flaw is triggered through unsafe handling of user-controlled data in the pages/select/ filter parameter or the preview/ data parameter, allowing arbitrary PHP execution...

CVE-2018-16762

CVE-2018-16762 affects FUEL CMS 1.4.1 and allows SQL Injection via the layout, published, or search_term parameters of pages/items. The root cause is improper input handling that enables crafted input to alter SQL queries. Documented impact includes high/severe CVSS metrics (e.g., CVSS v3 base sc...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

PT-2018-13726

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4.1 Description The issue allows for PHP code evaluation, potentially leading to pre-authentication remote code execution. This can be achieved via the filter parameter in the "pages/select/" endpoint or the data parameter i...

CVE-2018-16763

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Recent assessments: noraj at May 08, 2021 7:33pm UTC reported: Unauthenticated RCE with default config, this is critical. Assessed...

CVE-2018-16762: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16763: Improper Neutralization of Special Elements in Output Used by a Downstream Component

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...

PT-2018-13725

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4.1 Description The issue allows SQL Injection via the layout, published, or search term parameter to pages/items. Recommendations For FUEL CMS version 1.4.1, consider restricting access to the vulnerable parameters layout,...

FUEL CMS Cross-Site Request Forgery Vulnerability

FUEL CMS is a content management system based on CodeIgniter. A cross-site request forgery vulnerability exists in myprofile/edit?inline= in FUEL CMS 1.4, which can be exploited by remote attackers to change the administrator password...

CVE-2018-16416

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

CVE-2018-16416

The CVE-2018-16416 issue affects FUEL CMS 1.4, specifically a Cross-Site Request Forgery flaw in the my_profile/edit?inline= path. The underlying problem is CSRF that lets an attacker remotely change the administrator password. Connected records (Red Hat, CNVD, OSV, CVE lists) corroborate the sam...

CVE-2018-16416

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

CVE-2018-16416

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...

PT-2018-13553

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4 Description A cross-site request forgery issue exists, allowing remote attackers to modify the administrator's password via the "my profile/edit?inline=" endpoint. Recommendations For FUEL CMS version 1.4, consider disabli...

CVE-2018-16416: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in myprofile/edit?inline= in FUEL CMS 1.4 allows remote attackers to change the administrator's password...