PT-2026-28400 · Fuel Cms · Fuel Cms

Published 2026-03-26 · Updated 2026-03-29 · CVE-2026-30463

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Daylight Studio FuelCMS version 1.5.2

Description FuelCMS version 1.5.2 contains a SQL injection issue through the /controllers/Login.php component. The vulnerability is located in the /controllers/Login.php component and allows for potential SQL injection attacks. The vulnerable parameter is not specified.

Recommendations Update FuelCMS to a newer version that addresses this issue. As a temporary workaround, consider restricting access to the /controllers/Login.php component.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-30463

Affected Products

Fuel Cms

References · 5

• 🔥 https://pentest-tools.com/PTT-2025-030%E2%80%93SQL-Injection-via-Password-Reset.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30463 · Security Note
• https://twitter.com/CVEnew/status/2038135246261227601 · Twitter Post
• http://daylight.com · Note
• http://fuelcms.com · Note