https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-30459.htmlhttps://patchthecve.com/cve/CVE-2026-30459.htmlSun, 05 Jul 2026 17:17:28 +0000HIGH 7.1: An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.https://patchthecve.com/cve/CVE-2026-30461.htmlhttps://patchthecve.com/cve/CVE-2026-30461.htmlSun, 05 Jul 2026 17:17:29 +0000HIGH 8.3: Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.https://patchthecve.com/cve/CVE-2026-30460.htmlhttps://patchthecve.com/cve/CVE-2026-30460.htmlSun, 05 Jul 2026 17:17:29 +0000HIGH 8.8: Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.https://patchthecve.com/cve/CVE-2026-30463.htmlhttps://patchthecve.com/cve/CVE-2026-30463.htmlSun, 05 Jul 2026 17:17:29 +0000HIGH 7.7: Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.https://patchthecve.com/cve/CVE-2026-30458.htmlhttps://patchthecve.com/cve/CVE-2026-30458.htmlSun, 05 Jul 2026 17:17:28 +0000CRITICAL 9.1: An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.https://patchthecve.com/cve/CVE-2026-30457.htmlhttps://patchthecve.com/cve/CVE-2026-30457.htmlSun, 05 Jul 2026 17:17:28 +0000CRITICAL 9.8: An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.