Priority HIGH 74
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.52881 · Published 2020-12-02 · No fix listed
Priority HIGH 71
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.06079 · Published 2024-03-17 · No fix listed CWE-434
Priority HIGH 69
74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00587 · Published 2025-04-18 · No fix listed CWE-77
Priority MEDIUM 57
A vulnerability was found in 74CMS up to 3.33.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00741 · Published 2025-05-06 · No fix listed CWE-22
Priority MEDIUM 54
SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10098 · Published 2021-06-16 · No fix listed CWE-89
Priority MEDIUM 53
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0794 · Published 2021-06-16 · No fix listed CWE-89
Priority MEDIUM 53
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08579 · Published 2021-06-16 · No fix listed CWE-89
Priority MEDIUM 53
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08579 · Published 2021-06-16 · No fix listed CWE-89
Priority MEDIUM 50
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.09853 · Published 2019-04-20 · No fix listed CWE-352
Priority MEDIUM 49
In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and cont…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04414 · Published 2021-02-17 · No fix listed CWE-94
Priority MEDIUM 47
Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02411 · Published 2019-04-01 · No fix listed CWE-94
Priority MEDIUM 45
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01449 · Published 2021-06-16 · No fix listed CWE-89
Priority MEDIUM 40
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04515 · Published 2022-03-28 · No fix listed CWE-552
Priority LOW 37
An issue was discovered in 74cms v4.2.111.
CVSS 3.0HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01003 · Published 2018-12-27 · No fix listed CWE-20
Priority LOW 34
An issue was discovered in 74CMS v5.2.8.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0104 · Published 2019-10-15 · No fix listed CWE-89
Priority LOW 29
74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00827 · Published 2021-12-08 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in 74cms v4.2.111.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00707 · Published 2018-12-25 · No fix listed CWE-79
THREATIST.IORead the docs