PatchTheCVEfuel cms vulnerabilities and fixes
Recent CVEs affecting fuel cms, with upgrade or downgrade steps. 6 tracked.
Also searched as: fuelcms.
fuel cms has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-04-16. Highest priority: CVE-2026-30457 (score 60/100).
- CVE-2026-30463 HIGH 7.7 DOWNGRADE Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Lo
- CVE-2026-30461 HIGH 8.3 DOWNGRADE Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerab
- CVE-2026-30460 HIGH 8.8 DOWNGRADE Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerab
- CVE-2026-30459 HIGH 7.1 DOWNGRADE An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to
- CVE-2026-30458 CRITICAL 9.1 DOWNGRADE An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a m
- CVE-2026-30457 CRITICAL 9.8 DOWNGRADE DOWNGRADE An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary
FAQ
How do I fix fuel cms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fuel cms being exploited right now?
None of the tracked fuel cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fuel cms CVE should I patch first?
CVE-2026-30457 currently ranks highest (60/100): An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary.