PT-2026-41466 · Getfuelcms · Fuel Cms

Rahad Chowdhury · Published 2026-05-16 · Updated 2026-05-16 · CVE-2021-47980

NVD

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col' parameter to extract database information based on response time delays.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47980

Affected Products

Fuel Cms

References · 5

• 🔥 https://exploit-db.com/exploits/50523 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47980 · Security Note
• https://getfuelcms.com · Note
• https://vulncheck.com/advisories/fuel-cms-blind-sql-injection-via-col-parameter · Note
• https://github.com/daylightstudio/FUEL-CMS/archive/1.4.13.zip · Note