PT-2026-28399 · Daylight Studio · Fuel Cms

CVE-2026-30458 · Publicado 2026-03-26 · Atualizado 2026-03-29

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Daylight Studio FuelCMS version 1.5.2

Description An issue exists in Daylight Studio FuelCMS version 1.5.2 that allows attackers to obtain users' password reset tokens through a mail splitting attack. A mail splitting attack involves manipulating email systems to deliver multiple recipients' emails to unintended addresses, potentially exposing sensitive information.

Recommendations Update Daylight Studio FuelCMS to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-620

Identificadores relacionados

CVE-2026-30458

Produtos afetados

Fuel Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30458.json · Exploit
• 🔥 https://pentest-tools.com/PTT-2025-025-Account-Takeover-via-Email-Array.pdf · Exploit
• https://github.com/daylightstudio/FUEL-CMS · Nota
• http://daylight.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30458 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2038136889291473212 · Publicação no Twitter
• http://fuelcms.com · Nota
• https://twitter.com/TheHackerWire/status/2038043395734831512 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30458 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038135245237891355 · Publicação no Twitter