CVE-2020-35339
- EPSS 13.02%
- Veröffentlicht 17.02.2021 15:15:12
- Zuletzt bearbeitet 21.11.2024 05:27:11
In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server.
CVE-2020-29279
- EPSS 22.55%
- Veröffentlicht 02.12.2020 22:15:10
- Zuletzt bearbeitet 21.11.2024 05:23:51
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVE-2019-17612
- EPSS 0.32%
- Veröffentlicht 15.10.2019 23:15:08
- Zuletzt bearbeitet 21.11.2024 04:32:38
An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter.
CVE-2019-11374
- EPSS 3.05%
- Veröffentlicht 20.04.2019 15:29:00
- Zuletzt bearbeitet 21.11.2024 04:20:58
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-10684
- EPSS 0.78%
- Veröffentlicht 01.04.2019 16:29:00
- Zuletzt bearbeitet 21.11.2024 04:19:44
Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.
CVE-2018-20519
- EPSS 0.18%
- Veröffentlicht 27.12.2018 15:29:00
- Zuletzt bearbeitet 21.11.2024 04:01:38
An issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify arbitrary resumes by changing a job-search intention, as demonstrated by the index.php?c=Personal&a=ajax_save_basic pid parameter.
CVE-2018-20454
- EPSS 0.24%
- Veröffentlicht 25.12.2018 17:29:00
- Zuletzt bearbeitet 21.11.2024 04:01:31
An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via the key parameter.