CVE-2020-29279

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 52.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-12-02 · updated 2026-06-17

Description

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

Affected products

74CMS: before 6.0.48 — fixed in 6.0.48

How to fix

Upgrade to a fixed version: 74CMS 6.0.48. Check the vendor advisory for mitigations.

References

http://www.74cms.com/news/show-2497.html
https://github.com/BigTiger2020/74CMS/blob/main/README.md
http://www.74cms.com/news/show-2497.html
https://github.com/BigTiger2020/74CMS/blob/main/README.md

Get alerted when CVE-2020-29279 or the next vulnerability affects your stack