共找到 8 条公开漏洞记录
There is a libxml_disable_entity_loader function to prevent XML eXternal Entity Injection, but this function needs to be customized by the user. If the user does not customize it, there will be no filtering, which leads to SQL injection vulnerabilities.
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
A SQL injection vulnerability exists in 74cms 5.0.1 AjaxPersonalController.class.php.