{"id":"CVE-2018-16763","aliases":["EUVD-2018-8563","GHSA-rq3x-g9v8-6qjm"],"status":"published","title":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/...","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.82937,"percentile":0.99675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74"],"published":"2018-09-09T21:00:00Z","modified":"2026-10-20T10:50:04Z","exploits":[{"source":"exploitdb","id":"EDB-47138","title":"fuel CMS 1.4.1 - Remote Code Execution (1)","type":"webapps","platform":"linux","date":"2019-07-19","url":"https://www.exploit-db.com/exploits/47138"},{"source":"pocgithub","id":"dinhbaouit/CVE-2018-16763","title":"dinhbaouit/CVE-2018-16763","date":"2020-03-26","url":"https://github.com/dinhbaouit/CVE-2018-16763"},{"source":"pocgithub","id":"hikarihacks/CVE-2018-16763-exploit","title":"hikarihacks/CVE-2018-16763-exploit","date":"2020-09-03","url":"https://github.com/hikarihacks/CVE-2018-16763-exploit"},{"source":"pocgithub","id":"n3m1sys/CVE-2018-16763-Exploit-Python3","title":"n3m1sys/CVE-2018-16763-Exploit-Python3","date":"2020-10-10","url":"https://github.com/n3m1sys/CVE-2018-16763-Exploit-Python3"},{"source":"pocgithub","id":"uwueviee/Fu3l-F1lt3r","title":"uwueviee/Fu3l-F1lt3r","date":"2021-01-15","url":"https://github.com/uwueviee/Fu3l-F1lt3r"},{"source":"exploitdb","id":"EDB-49487","title":"Fuel CMS 1.4.1 - Remote Code Execution (2)","type":"webapps","platform":"php","date":"2021-01-28","url":"https://www.exploit-db.com/exploits/49487"},{"source":"pocgithub","id":"shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE--","title":"shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE--","date":"2021-03-07","url":"https://github.com/shoamshilo/Fuel-CMS-Remote-Code-Execution-1.4--RCE--"},{"source":"pocgithub","id":"kxisxr/Bash-Script-CVE-2018-16763","title":"kxisxr/Bash-Script-CVE-2018-16763","date":"2021-09-27","url":"https://github.com/kxisxr/Bash-Script-CVE-2018-16763"},{"source":"exploitdb","id":"EDB-50477","title":"Fuel CMS 1.4.1 - Remote Code Execution (3)","type":"webapps","platform":"php","date":"2021-11-03","url":"https://www.exploit-db.com/exploits/50477"},{"source":"pocgithub","id":"padsalatushal/CVE-2018-16763","title":"padsalatushal/CVE-2018-16763","date":"2021-11-03","url":"https://github.com/padsalatushal/CVE-2018-16763"},{"source":"pocgithub","id":"h3x0v3rl0rd/CVE-2018-16763","title":"h3x0v3rl0rd/CVE-2018-16763","date":"2022-01-08","url":"https://github.com/h3x0v3rl0rd/CVE-2018-16763"},{"source":"pocgithub","id":"BrunoPincho/cve-2018-16763-rust","title":"BrunoPincho/cve-2018-16763-rust","date":"2022-01-27","url":"https://github.com/BrunoPincho/cve-2018-16763-rust"},{"source":"pocgithub","id":"p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE","title":"p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE","date":"2022-05-31","url":"https://github.com/p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE"},{"source":"pocgithub","id":"not1cyyy/CVE-2018-16763","title":"not1cyyy/CVE-2018-16763","date":"2023-01-03","url":"https://github.com/not1cyyy/CVE-2018-16763"},{"source":"pocgithub","id":"antisecc/CVE-2018-16763","title":"antisecc/CVE-2018-16763","date":"2023-06-09","url":"https://github.com/antisecc/CVE-2018-16763"},{"source":"pocgithub","id":"VitoBonetti/CVE-2018-16763","title":"VitoBonetti/CVE-2018-16763","date":"2023-07-16","url":"https://github.com/VitoBonetti/CVE-2018-16763"},{"source":"pocgithub","id":"kaxm23/exploit_cms_fuel","title":"kaxm23/exploit_cms_fuel","date":"2023-09-11","url":"https://github.com/kaxm23/exploit_cms_fuel"},{"source":"pocgithub","id":"saccles/CVE_2018_16763_Proof_of_Concept","title":"saccles/CVE_2018_16763_Proof_of_Concept","date":"2024-12-04","url":"https://github.com/saccles/CVE_2018_16763_Proof_of_Concept"},{"source":"pocgithub","id":"altsun/CVE-2018-16763-FuelCMS-1.4.1-RCE","title":"altsun/CVE-2018-16763-FuelCMS-1.4.1-RCE","date":"2025-01-08","url":"https://github.com/altsun/CVE-2018-16763-FuelCMS-1.4.1-RCE"},{"source":"pocgithub","id":"ArtemCyberLab/Project-Exploiting-a-Vulnerability-in-Fuel-CMS-CVE-2018-16763-","title":"ArtemCyberLab/Project-Exploiting-a-Vulnerability-in-Fuel-CMS-CVE-2018-16763-","date":"2025-04-13","url":"https://github.com/ArtemCyberLab/Project-Exploiting-a-Vulnerability-in-Fuel-CMS-CVE-2018-16763-"},{"source":"pocgithub","id":"bad-c0de/CVE-2018-16763_FuelCMS-1.4.1_RCE","title":"bad-c0de/CVE-2018-16763_FuelCMS-1.4.1_RCE","date":"2025-09-09","url":"https://github.com/bad-c0de/CVE-2018-16763_FuelCMS-1.4.1_RCE"},{"source":"pocgithub","id":"Cyberuser-hash/CVE-2018-16763","title":"Cyberuser-hash/CVE-2018-16763","date":"2025-10-05","url":"https://github.com/Cyberuser-hash/CVE-2018-16763"},{"source":"pocgithub","id":"estebanzarate/CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC","title":"estebanzarate/CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC","date":"2026-04-09","url":"https://github.com/estebanzarate/CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC"},{"source":"pocgithub","id":"SOME-1HING/CVE-2018-16763","title":"SOME-1HING/CVE-2018-16763","date":"2026-06-08","url":"https://github.com/SOME-1HING/CVE-2018-16763"},{"source":"pocgithub","id":"ShadowR-Root/fuel-cms-cve-2018-16763-python3-port","title":"ShadowR-Root/fuel-cms-cve-2018-16763-python3-port","date":"2026-08-07","url":"https://github.com/ShadowR-Root/fuel-cms-cve-2018-16763-python3-port"},{"source":"pocgithub","id":"gh0stuncle/CVE-2018-16763_fuel_cms_exploit","title":"gh0stuncle/CVE-2018-16763_fuel_cms_exploit","date":"2026-08-25","url":"https://github.com/gh0stuncle/CVE-2018-16763_fuel_cms_exploit"},{"source":"pocgithub","id":"che3axujnya/cve-2018-16763","title":"che3axujnya/cve-2018-16763","date":"2026-10-21","url":"https://github.com/che3axujnya/cve-2018-16763"},{"source":"nuclei","id":"CVE-2018-16763","title":"FUEL CMS 1.4.1 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-16763.yaml"}],"products":[{"vendor":"thedaylightstudio","product":"fuel_cms"}],"references":[{"url":"https://github.com/daylightstudio/FUEL-CMS/issues/478","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://0xd0ff9.wordpress.com/2019/07/19/from-code-evaluation-to-pre-auth-remote-code-execution-cve-2018-16763-bypass/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.exploit-db.com/exploits/47138","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/153696/fuelCMS-1.4.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/160080/Fuel-CMS-1.4-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/164756/Fuel-CMS-1.4.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16763"},{"url":"https://github.com/advisories/GHSA-rq3x-g9v8-6qjm"}],"sources":{"cve":[{"id":"CVE-2018-16763","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","status":"published","published":"2018-09-09T21:00:00Z","modified":"2024-08-05T10:32:54.076Z","updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8563","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","status":"published","published":"2018-09-09T21:00:00Z","modified":"2024-08-05T10:32:54Z","updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-rq3x-g9v8-6qjm","title":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/...","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","status":"published","published":"2022-05-13T01:04:43Z","modified":"2023-02-01T05:02:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2018-16763","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","status":"published","published":"2018-09-09T21:29:00.713Z","modified":"2026-06-17T01:44:46.597Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"CVE-2018-16763","description":"FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.","status":"published","published":"2018-09-09T21:29:00.713Z","modified":"2026-10-20T10:50:04.017781821Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:08.533609Z"}]}}