Thedaylightstudio vulnerabilities
We track 3 vulnerabilities in Thedaylightstudio products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on April 16, 2026.
3vulnerabilities
1critical
2high
1exploited
8.4average CVSS score
Latest Thedaylightstudio vulnerabilities
- 7.1 High severity
Fuel CMS: Weak Password Recovery Mechanism for Forgotten Password
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- 8.3 High severity
Fuel CMS: Improper Neutralization of Special Elements used in a Command
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.
- 9.8 Critical severity
Fuel CMS SQL Injection Exploited
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.