Vulnerabilities

Filters

Reset all

1 selected

36 records

Sort

Vendor: 74cms Clear all filters

TI-2025-03858 CVE-2025-4329 · GHSA-57q6-qxwh-25fx

74CMS index path traversal

MEDIUM 57

A vulnerability was found in 74CMS up to 3.33.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00741 Published 2025-05-06 No fix listed CWE-22

TI-2024-30891 CVE-2024-46089 · GHSA-ggjj-3vpj-g73c

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

HIGH 69

74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00587 Published 2025-04-18 No fix listed CWE-77

TI-2024-02381 CVE-2024-2561 · GHSA-r5m2-89jg-5848

74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload

HIGH 71

A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06079 Published 2024-03-17 No fix listed CWE-434

TI-2022-20424 CVE-2022-42154 · GHSA-j5m8-qv5m-qxgq

An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of…

HIGH 76

An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01224 Published 2022-10-17 No fix listed CWE-434

TI-2022-19906 CVE-2022-41472 · GHSA-644c-2pfr-gp8w

74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via…

MEDIUM 60

74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00474 Published 2022-10-17 No fix listed CWE-79

TI-2022-19905 CVE-2022-41471 · GHSA-8v53-3fqj-gjv3

74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily…

MEDIUM 62

74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00665 Published 2022-10-17 No fix listed

TI-2022-14560 CVE-2022-33097 · GHSA-j7gg-95j2-pq75

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword…

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14559 CVE-2022-33096 · GHSA-5wrc-6px4-6v9q

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14558 CVE-2022-33095 · GHSA-vv2w-88fw-wvhr

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword…

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01063 Published 2022-06-22 No fix listed CWE-89

TI-2022-14557 CVE-2022-33094 · GHSA-w35m-6h5w-mx8q

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14556 CVE-2022-33093 · GHSA-p9qm-4pvg-7rjr

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-14555 CVE-2022-33092 · GHSA-v453-hw53-7pj2

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.

LOW 35

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2022-06-22 No fix listed CWE-89

TI-2022-13870 CVE-2022-32131 · GHSA-xcwv-7f8g-2v7r

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS)…

LOW 28

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.