ACTIVELY EXPLOITED
CVE-2020-17463: Fuel CMS SQL Injection Vulnerability
| Vendor | Fuel CMS |
|---|---|
| Product | Fuel CMS |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Dec 2021 |
| CISA federal deadline | 10 Jun 2022 |
| Weakness (CWE) | CWE-89 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.