CVE-2020-24950

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-11 · updated 2026-06-17
Weakness: CWE-89

Description

SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items.

Affected products

Thedaylightstudio Fuel Cms: 1.4.9

References

https://github.com/daylightstudio/FUEL-CMS/issues/562
https://github.com/daylightstudio/FUEL-CMS/issues/562

Get alerted when CVE-2020-24950 or the next vulnerability affects your stack