CVE-2018-20137

4.8 mediumEPSS 0.6%

Medium (4.8) in thedaylightstudio fuel cms. EPSS 0.6% chance of exploitation in the next 30 days.

XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.

Severity

CVSS 3.0

4.8 medium

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-12-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

thedaylightstudio:fuel_cms

References

https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss1
https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss1

Check your stack JSON