Priority HIGH 81
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.3949 · Published 2026-04-01 · No fix listed CWE-94
Priority HIGH 73
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00401 · Published 2022-12-07 · No fix listed CWE-352
Priority HIGH 72
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00505 · Published 2025-11-06 · No fix listed CWE-611
Priority HIGH 71
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00469 · Published 2026-10-22 · Fixed in 6.1.1 CWE-22
Priority MEDIUM 62
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 62
An issue was discovered in MetInfo 7.0.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.48366 · Published 2019-10-09 · No fix listed CWE-89
Priority MEDIUM 62
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.48465 · Published 2019-09-30 · No fix listed CWE-89
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 46
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01739 · Published 2021-07-12 · No fix listed CWE-89
Priority MEDIUM 46
SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01739 · Published 2021-07-12 · No fix listed CWE-89
Priority MEDIUM 46
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02101 · Published 2021-08-03 · No fix listed CWE-22
Priority MEDIUM 46
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.12117 · Published 2019-09-30 · No fix listed CWE-89
Priority MEDIUM 45
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01575 · Published 2022-02-14 · No fix listed CWE-89
Priority MEDIUM 45
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01575 · Published 2022-02-14 · No fix listed CWE-89
Priority MEDIUM 45
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01627 · Published 2021-09-15 · No fix listed CWE-89
Priority MEDIUM 45
An issue was discovered in MetInfo v7.0.0 beta.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01507 · Published 2020-09-29 · No fix listed CWE-89
Priority MEDIUM 45
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01508 · Published 2021-07-29 · No fix listed CWE-89
Priority MEDIUM 45
An issue was discovered in MetInfo v7.0.0 beta.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01507 · Published 2019-10-14 · No fix listed CWE-89
Priority MEDIUM 45
An issue was discovered in MetInfo 6.0.0.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01553 · Published 2018-06-18 · No fix listed CWE-94
Priority MEDIUM 44
MetInfo 7.0 beta is affected by a file modification vulnerability.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02201 · Published 2021-05-24 · No fix listed CWE-22
Priority MEDIUM 42
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/ph…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01734 · Published 2017-07-16 · No fix listed
Priority MEDIUM 41
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01269 · Published 2019-07-19 · No fix listed CWE-89
Load more
THREATIST.IORead the docs