CVE-2020-17463

thedaylightstudio fuel cms

Published 13 Aug 2020 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Dec 2021, with a remediation deadline of 10 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

References

packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injection.html · Exploit, Third Party Advisory, VDB Entry
cwe.mitre.org/data/definitions/89.html · Technical Description
getfuelcms.com/ · Vendor Advisory
github.com/daylightstudio/FUEL-CMS/archive/master.zip · Third Party Advisory
github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.8 · Release Notes, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17463 · US Government Resource