CVE-2026-30463 identifies a SQL injection vulnerability in Daylight Studio FuelCMS v1.5.2 specifically via the /controllers/Login.php component. This vulnerability allows remote attackers to inject SQL commands without authentication, potentially compromising the confidentiality and integrity of the database. The CVSS 3.1 base score is 7.7, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity, and low impact on availability. No known exploits in the wild or vendor advisories are currently available.

Successful exploitation of this SQL injection vulnerability could allow attackers to access or modify sensitive data stored in the backend database, leading to confidentiality and integrity breaches. The availability impact is considered low. There is no information about active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected component or applying web application firewall rules to detect and block SQL injection attempts targeting /controllers/Login.php.