Security readout for executives and security teams
Plain-English summary
CVE-2026-30463 is a high-severity SQL injection issue reported in Daylight Studio FuelCMS v1.5.2, in the Login.php password reset/login-related component. If reachable, it could expose or alter database data. The provided sources do not name a vendor patch or confirm exploitation.
Executive priority
Treat this as a high-priority exposure review for any FuelCMS v1.5.2 deployment. The business risk is potential database compromise from an unauthenticated web path, but remediation planning should be grounded in vendor guidance because the provided sources do not name a patch.
Technical view
The CVE describes CWE-89 SQL injection in /controllers/Login.php for FuelCMS v1.5.2. CVSS 3.1 is 7.7: network reachable, unauthenticated, no user interaction, high complexity, high confidentiality and integrity impact, and low availability impact. Public affected CPE data is not provided.
Likely exposure
Organizations should prioritize systems running Daylight Studio FuelCMS v1.5.2, especially internet-facing instances with reachable login or password reset functionality. Exposure is uncertain where FuelCMS versions are undocumented, customized, or bundled into other sites.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The referenced PDF title indicates SQL injection via password reset, but the bundle does not provide enough detail to assess exploit maturity, public proof-of-concept availability, or real-world targeting.
Researcher notes
Evidence is sparse: NVD-style affected product fields are n/a, CPEs are absent, and the external reference is a PDF title indicating SQL injection via password reset. Avoid assuming impact beyond the CVSS vector and CVE description without reviewing the full vendor or researcher publication.
Mitigation direction
- Check Daylight Studio or FuelCMS guidance for an official fixed version or advisory.
- Upgrade away from FuelCMS v1.5.2 if a vendor-supported fixed release exists.
- Restrict public access to administrative login and password reset surfaces where feasible.
- Apply WAF or database-layer SQL injection protections as temporary compensating controls.
- Increase monitoring for login, password reset, and database error anomalies.
Validation and detection
- Inventory websites and applications for FuelCMS and confirm exact deployed versions.
- Identify whether /controllers/Login.php or related password reset functionality is reachable.
- Review application logs for abnormal password reset, login, or database error patterns.
- Use only authorized, non-destructive testing in staging or approved production windows.
- Confirm whether vendor guidance names patches, workarounds, or unsupported versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-30463 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L2.25.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://pentest-tools.com/PTT-2025-030%E2%80%93SQL-Injection-via-Password-Reset.pdfCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.