Secuno
ENNL
Book demo

CVE-2020-17463

Fuel CMS SQL Injection

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 89.7%
  1. Published13 Aug 2020
  2. Added to CISA KEV10 Dec 2021
  3. Remediation due10 Jun 2022
Actively exploited (CISA KEV)

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Added to KEV: 10 Dec 2021Federal remediation due: 10 Jun 2022

Description

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Thedaylightstudio Fuel CMS1.4.7

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-891138.8
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it…
CVE-2026-1096088.8
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection…
CVE-2026-1095738.1
phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(),…
CVE-2026-893028.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and…
CVE-2026-892998.6
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape…
CVE-2026-892978.6
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and…

Frequently asked

Is CVE-2020-17463 being actively exploited?

Yes. CVE-2020-17463 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 10 Dec 2021.

How severe is CVE-2020-17463?

CVE-2020-17463 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 89.7% probability of exploitation.

Which products are affected by CVE-2020-17463?

Affected products include Thedaylightstudio Fuel CMS.

How do I fix CVE-2020-17463?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-17463 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.