Fuel CMS vulnerabilities

3 known vulnerabilities in Fuel CMS from Thedaylightstudio. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Fuel CMS: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-30459Apr 16, 2026Thedaylightstudio

  An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

• 8.3 High severity

  Fuel CMS: Improper Neutralization of Special Elements used in a Command

  CVE-2026-30461Apr 15, 2026Thedaylightstudio

  Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

• 9.8 Critical severity

  Fuel CMS SQL Injection Exploited

  CVE-2020-17463Aug 13, 2020ThedaylightstudioEPSS 89.7%

  FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.