Vulnerabilities

TI-2025-03858 CVE-2025-4329 · GHSA-57q6-qxwh-25fx

74CMS index path traversal

MEDIUM 57

A vulnerability was found in 74CMS up to 3.33.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00741 Published 2025-05-06 No fix listed CWE-22

TI-2024-30891 CVE-2024-46089 · GHSA-ggjj-3vpj-g73c

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

HIGH 69

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00587 Published 2025-04-18 No fix listed CWE-77

TI-2024-02381 CVE-2024-2561 · GHSA-r5m2-89jg-5848

74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload

HIGH 71

A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06079 Published 2024-03-17 No fix listed CWE-434

TI-2022-09666 CVE-2022-26271 · GHSA-gpcv-cxpv-wv29

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the…

MEDIUM 40

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04515 Published 2022-03-28 No fix listed CWE-552

TI-2020-14336 CVE-2020-22421 · GHSA-w27q-xjw8-g94c

74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via…

LOW 29

74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-08 No fix listed CWE-79

TI-2020-14304 CVE-2020-22212 · GHSA-wwjr-5j85-98m8

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.

MEDIUM 45

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2021-06-16 No fix listed CWE-89

TI-2020-14303 CVE-2020-22211 · GHSA-x988-8hhc-g6v9

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0794 Published 2021-06-16 No fix listed CWE-89

TI-2020-14302 CVE-2020-22210 · GHSA-vjg6-2q25-fqrp

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08579 Published 2021-06-16 No fix listed CWE-89

TI-2020-14301 CVE-2020-22209 · GHSA-76x6-c49p-vv53

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

MEDIUM 53

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08579 Published 2021-06-16 No fix listed CWE-89

TI-2020-14300 CVE-2020-22208 · GHSA-6c25-62ch-w9gq

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

MEDIUM 54

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10098 Published 2021-06-16 No fix listed CWE-89

TI-2020-17946 CVE-2020-35339 · GHSA-cv7g-j45h-87jf

In 74cms version 5.0.1, there is a remote code execution vulnerability in…

MEDIUM 49

In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and cont…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04414 Published 2021-02-17 No fix listed CWE-94

TI-2020-17624 CVE-2020-29279 · GHSA-j5rq-6w98-hx99

PHP remote file inclusion in the assign_resume_tpl method in…

HIGH 74

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.52881 Published 2020-12-02 No fix listed

TI-2019-13147 CVE-2019-17612 · GHSA-p7fg-6vqv-fphv

An issue was discovered in 74CMS v5.2.8.

LOW 34

An issue was discovered in 74CMS v5.2.8.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0104 Published 2019-10-15 No fix listed CWE-89

TI-2019-08496 CVE-2019-11374 · GHSA-wgwj-jmrp-rx5m

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

MEDIUM 50

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.09853 Published 2019-04-20 No fix listed CWE-352

TI-2019-07974 CVE-2019-10684 · GHSA-8ffw-gxc2-m2wc

Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote…

MEDIUM 47

Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02411 Published 2019-04-01 No fix listed CWE-94

TI-2018-14549 CVE-2018-20519 · GHSA-fvjc-j5cj-ghc3

An issue was discovered in 74cms v4.2.111.

LOW 37

An issue was discovered in 74cms v4.2.111.

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.01003 Published 2018-12-27 No fix listed CWE-20

TI-2018-14496 CVE-2018-20454 · GHSA-w26p-xmcc-j8ff

An issue was discovered in 74cms v4.2.111.

LOW 28

An issue was discovered in 74cms v4.2.111.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00707 Published 2018-12-25 No fix listed CWE-79

Vulnerabilities

Filters