A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score
4.3
EPSS Score
0.001
Published
2025-05-06
74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.
CVSS Score
6.3
EPSS Score
0.004
Published
2025-04-18
SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
CVSS Score
9.8
EPSS Score
0.436
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
CVSS Score
9.8
EPSS Score
0.459
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
CVSS Score
9.8
EPSS Score
0.459
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
CVSS Score
9.8
EPSS Score
0.371
Published
2021-06-16
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
CVSS Score
9.8
EPSS Score
0.005
Published
2021-06-16
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVSS Score
9.8
EPSS Score
0.226
Published
2020-12-02