Vulnerability · Published May 16, 2026 · Assigned by VulnCheck
CVE-2021-47980Fuel CMS 1.4.13 Blind SQL Injection via col Parameter
High 7.1
In plain English
A high-severity SQL injection in Fuel CMS from Getfuelcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col' parameter to extract database information based on response time delays.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Getfuelcms | Fuel CMS | 1.4.13 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-50523 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Fuel CMS 1.4.13 Blind SQL Injection via col Parameter third-party-advisory