CVE-2020-17463: Fuel CMS SQL Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 89.7% chance of exploitation in the next 30 days.

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Affected products

• Thedaylightstudio Fuel CMS: version 1.4.7 only

Published 2020-08-13. Last modified 2026-06-17.