CVE-2020-29279

CRITICAL

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS52.9%
Percentile99th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in 74CMS before version 6.0.48 allows remote code execution through a PHP remote file inclusion flaw in the assign_resume_tpl method in BaseController.class.php.

BSID: BS-2020-GLOBAL-181147-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-29279?
A critical vulnerability in 74CMS before version 6.0.48 allows remote code execution through a PHP remote file inclusion flaw in the assign_resume_tpl method in BaseController.class.php.
What is the CVSS score for CVE-2020-29279?
CVE-2020-29279 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 52.9%.
Is CVE-2020-29279 actively exploited?
No confirmed active exploitation of CVE-2020-29279 as of 2026-09-25.
How do I remediate CVE-2020-29279?
Priority: IMMEDIATE. Advisory: http://www.74cms.com/news/show-2497.html PSIRT: [email protected]
What systems are affected by CVE-2020-29279?
CVE-2020-29279 affects 74Cms 74Cms.
Vulnerability Details
CVE IDCVE-2020-29279
BSIDBS-2020-GLOBAL-181147-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-12-02
Last Modified2026-06-17
ICS Relevance0%
SourceNVD
Official Description

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting a malicious URL into the assign_resume_tpl method, which can lead to the execution of arbitrary code on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
74Cms 74Cms < 6.0.48
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2143 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash2758fd2a57413f805d623ccf2cda5abb880ffc5d6324e90a30c2473cc434c1f3b3f8e264f13a662c8ac8b338c0d1cc81bcbfdd16c51daeedae9a4dd0fab0d883
Related CVEs affecting 74Cms
CVE-2020-22209 9.8 SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. CVE-2019-10684 9.8 Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allow... CVE-2020-22208 9.8 SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. CVE-2020-35339 9.8 In 74cms version 5.0.1, there is a remote code execution vulnerability in /Ap... CVE-2020-22210 9.8 SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
View all 74Cms CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →