A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score
4.3
EPSS Score
0.001
Published
2025-05-06
74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.
CVSS Score
6.3
EPSS Score
0.004
Published
2025-04-18
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.php#sendCompanyLogo of the component Company Logo Handler. The manipulation of the argument imgBase64 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257060.
CVSS Score
6.3
EPSS Score
0.154
Published
2024-03-17
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
CVSS Score
7.5
EPSS Score
0.098
Published
2022-03-28
74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-12-08
SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
CVSS Score
9.8
EPSS Score
0.436
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
CVSS Score
9.8
EPSS Score
0.459
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
CVSS Score
9.8
EPSS Score
0.459
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
CVSS Score
9.8
EPSS Score
0.371
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
CVSS Score
9.8
EPSS Score
0.005
Published
2021-06-16
Page 1