FUEL CMS Elevation of Privilege Vulnerability

FUEL CMS is a content management system based on CodeIgniter. An elevation of privilege vulnerability exists in FUEL CMS 1.4.7. The vulnerability can be exploited to gain super administrator privileges via the "id" and "fuelid" parameters...

FUEL CMS Cross-Site Scripting Vulnerability (CNVD-2021-17199)

FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.7. An attacker can exploit this vulnerability to conduct cross-site scripting attacks bypassing filters via /fuelCM/fuel/pages/edit/1?lang=english...

FUEL CMS SQL Injection Vulnerability (CNVD-2021-17201)

FUEL CMS is a content management system based on CodeIgniter. A SQL injection vulnerability exists in the 'fuelreplaceid' parameter in pages/replace/1 in FUEL CMS 1.4.8. An attacker could use this vulnerability to corrupt the application, access or modify data, or exploit a potential vulnerabilit...

CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

CVE-2020-28705

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

CVE-2020-23721

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-23721

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

CVE-2020-28705

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

Cross site request forgery (csrf)

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

Cross site scripting

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english...

Sql injection

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

Privilege escalation

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

CVE-2020-28705

CVE-2020-28705 affects FUEL CMS 1.4.13. The vulnerability is a cross-site request forgery (CSRF) that allows an attacker to delete a page by sending a POST to /pages/delete/3. The connected records confirm the CVE description and impact (CSRF; delete page) but do not provide exploitation status o...

CVE-2020-28705

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

CVE-2020-24791

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-24791

FUEL CMS 1.4.8 contains a SQL injection in the fuel_replace_id parameter of pages/replace/1. The root cause is an injection vector that allows an attacker to read/modify data and potentially exploit underlying database vulnerabilities. Impact is described as compromising the application and data ...

CVE-2020-23722

CVE-2020-23722 affects FUEL CMS 1.4.7 . The connected documents describe an elevation of privilege vulnerability that enables an attacker to obtain super administrator privileges via manipulation of the id and fuel_id parameters. No root cause, affected versions, or exploitation details are expli...