CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Fuel CMS SQL Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
Affected products
thedaylightstudio: fuel cms
References10
- getfuelcms.com Vendor Advisory
- getfuelcms.com Vendor Advisory
- packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injecti… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/158840/Fuel-CMS-1.4.7-SQL-Injecti… ExploitThird Party AdvisoryVDB Entry
- cwe.mitre.org/data/definitions/89.html Technical Description
- github.com/daylightstudio/FUEL-CMS/archive/master.zip Third Party Advisory
- github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.8 Release NotesThird Party Advisory
- cwe.mitre.org/data/definitions/89.html Technical Description
- github.com/daylightstudio/FUEL-CMS/archive/master.zip Third Party Advisory
- github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.8 Release NotesThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 90% percentile: 100 · as of 2 November 2026
- CWE
- CWE-89