74cms

Records36All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

74cms records in CISA KEV

No 74cms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

74cmsse 19 records HIGH 74cms 17 records HIGH

Records

36 records

TI-2022-20424 CVE-2022-42154 · GHSA-j5m8-qv5m-qxgq

An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of…

HIGH 76

An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01224 Published 2022-10-17 No fix listed CWE-434

TI-2020-17624 CVE-2020-29279 · GHSA-j5rq-6w98-hx99

PHP remote file inclusion in the assign_resume_tpl method in…

HIGH 74

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.52881 Published 2020-12-02 No fix listed

TI-2024-02381 CVE-2024-2561 · GHSA-r5m2-89jg-5848

74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload

HIGH 71

A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06079 Published 2024-03-17 No fix listed CWE-434

TI-2024-30891 CVE-2024-46089 · GHSA-ggjj-3vpj-g73c

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

HIGH 69

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00587 Published 2025-04-18 No fix listed CWE-77

TI-2022-19905 CVE-2022-41471 · GHSA-8v53-3fqj-gjv3

74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily…

MEDIUM 62

74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00665 Published 2022-10-17 No fix listed

TI-2022-19906 CVE-2022-41472 · GHSA-644c-2pfr-gp8w

74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via…

MEDIUM 60

74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00474 Published 2022-10-17 No fix listed CWE-79

TI-2025-03858 CVE-2025-4329 · GHSA-57q6-qxwh-25fx

74CMS index path traversal

MEDIUM 57

A vulnerability was found in 74CMS up to 3.33.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00741 Published 2025-05-06 No fix listed CWE-22

TI-2020-14300 CVE-2020-22208 · GHSA-6c25-62ch-w9gq

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

MEDIUM 54

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10098 Published 2021-06-16 No fix listed CWE-89

TI-2020-14303 CVE-2020-22211 · GHSA-x988-8hhc-g6v9

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0794 Published 2021-06-16 No fix listed CWE-89

TI-2020-14302 CVE-2020-22210 · GHSA-vjg6-2q25-fqrp

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08579 Published 2021-06-16 No fix listed CWE-89

TI-2020-14301 CVE-2020-22209 · GHSA-76x6-c49p-vv53

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08579 Published 2021-06-16 No fix listed CWE-89

TI-2019-08496 CVE-2019-11374 · GHSA-wgwj-jmrp-rx5m

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

MEDIUM 50

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.09853 Published 2019-04-20 No fix listed CWE-352

TI-2020-17946 CVE-2020-35339 · GHSA-cv7g-j45h-87jf

In 74cms version 5.0.1, there is a remote code execution vulnerability in…

MEDIUM 49

In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and cont…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04414 Published 2021-02-17 No fix listed CWE-94

TI-2019-07974 CVE-2019-10684 · GHSA-8ffw-gxc2-m2wc

Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote…

MEDIUM 47

Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02411 Published 2019-04-01 No fix listed CWE-94

TI-2020-14304 CVE-2020-22212 · GHSA-wwjr-5j85-98m8

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.

MEDIUM 45

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2021-06-16 No fix listed CWE-89

TI-2022-09666 CVE-2022-26271 · GHSA-gpcv-cxpv-wv29

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the…

MEDIUM 40

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04515 Published 2022-03-28 No fix listed CWE-552

TI-2018-14549 CVE-2018-20519 · GHSA-fvjc-j5cj-ghc3

An issue was discovered in 74cms v4.2.111.

LOW 37

An issue was discovered in 74cms v4.2.111.

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.01003 Published 2018-12-27 No fix listed CWE-20

TI-2022-14560 CVE-2022-33097 · GHSA-j7gg-95j2-pq75

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword…

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14559 CVE-2022-33096 · GHSA-5wrc-6px4-6v9q

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14558 CVE-2022-33095 · GHSA-vv2w-88fw-wvhr

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword…

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01063 Published 2022-06-22 No fix listed CWE-89

TI-2022-14557 CVE-2022-33094 · GHSA-w35m-6h5w-mx8q

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14556 CVE-2022-33093 · GHSA-p9qm-4pvg-7rjr

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14555 CVE-2022-33092 · GHSA-v453-hw53-7pj2

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-12119 CVE-2022-29721 · GHSA-8g63-xg9f-396j

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword…

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01059 Published 2022-05-26 No fix listed CWE-89

TI-2022-12118 CVE-2022-29720 · GHSA-2rmx-8hf9-hm7v

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the…

LOW 35

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00975 Published 2022-05-26 No fix listed CWE-552

Open these records in search →

Critical	9
High	13
Medium	14
Low	0
No CVSS	0