CVE-2019-15228

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/daylightstudio/FUEL-CMS/issues/536Exploit, Third Party Advisory
https://www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xssExploit, Third Party Advisory
https://github.com/daylightstudio/FUEL-CMS/issues/536Exploit, Third Party Advisory
https://www.sevenlayers.com/index.php/237-fuelcms-1-4-4-xssExploit, Third Party Advisory

Timeline

Published: Aug 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-152298.8FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the admini CVE-2019-152305.4LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections CVE-2019-152329.8Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session CVE-2019-152336.1The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Se CVE-2019-152347.5SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the n CVE-2019-152356.5CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/se CVE-2019-152377.4Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.CVE-2019-152388.8The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-152397.8In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the CVE-2019-152408.0Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute CVE-2019-152418.0Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute CVE-2019-152428.0Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute