Design/Logic Flaw

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

CVE-2020-26167

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

CVE-2020-26167

Summary: CVE-2020-26167 affects FUEL CMS up to version 11.4.12. The vulnerability arises in the page preview feature, enabling an anonymous user to take complete ownership of any account, including administrator ones. This is described consistently across multiple sources (NVD entry and Red Hat a...

hydrogenfuelsystems.com.au Cross Site Scripting vulnerability OBB-1483184

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-26167: Undefined Security Weakness

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one...

PT-2020-16324

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 11.4.12 and earlier Description The page preview feature in FUEL CMS allows an anonymous user to take complete ownership of any account, including an administrator account. Recommendations For versions 11.4.12 and earlier, as...

fuelsuplementos.com.br Cross Site Scripting vulnerability OBB-1443254

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Fuel CMS 1.4.8 SQL Injection

Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...

Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)

Exploit Title: Fuel CMS 1.4.8 - 'fuelreplaceid' SQL Injection Authenticated Date: 2020-08-19 Exploit Author: c0mpu7er（@ymbank.cn） Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip Version: 1.4.7 Tested on: PHP 5.4.45, Apache...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

Sql injection

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

CVE-2020-17463

Summary: CVE-2020-17463 affects Fuel CMS 1.4.7 and enables SQL Injection via the col parameter in /pages/items, /permissions/items, or /navigation/items. The underlying issue is a CWE-89-style vulnerable input handling that allows untrusted input to affect SQL queries. Impact in sources: high, in...

CVE-2020-17463

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2020-17463: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...

PT-2020-6685

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.4.7 Description The issue is related to a lack of protection in the SQL query structure, allowing for SQL injection. This can be exploited via the col parameter in API endpoints such as "/pages/items", "/permissions/items", ...

Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)

Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection Authenticated Google Dork: - Date: 2020-08-01 Exploit Author: Roel van Beurden Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.7.zip Version: 1.4.7 Tested on: Linux Ubuntu 18.04...