Priority HIGH 71
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00469 · Published 2026-10-22 · Fixed in 6.1.1 CWE-22
Priority HIGH 81
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.3949 · Published 2026-04-01 · No fix listed CWE-94
Priority HIGH 72
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00505 · Published 2025-11-06 · No fix listed CWE-611
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00261 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 62
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority HIGH 73
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00401 · Published 2022-12-07 · No fix listed CWE-352
Priority MEDIUM 45
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01575 · Published 2022-02-14 · No fix listed CWE-89
Priority MEDIUM 45
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01575 · Published 2022-02-14 · No fix listed CWE-89
Priority LOW 25
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00581 · Published 2021-12-22 · No fix listed CWE-79
Priority MEDIUM 45
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01627 · Published 2021-09-15 · No fix listed CWE-89
Priority LOW 39
MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00632 · Published 2021-09-15 · No fix listed CWE-352
Priority LOW 36
A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0135 · Published 2021-08-12 · No fix listed CWE-89
Priority MEDIUM 46
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02101 · Published 2021-08-03 · No fix listed CWE-22
Priority LOW 37
An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01903 · Published 2021-08-03 · No fix listed CWE-22
Priority MEDIUM 45
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01508 · Published 2021-07-29 · No fix listed CWE-89
Priority LOW 39
Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00709 · Published 2021-07-29 · No fix listed CWE-352
Priority MEDIUM 46
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01739 · Published 2021-07-12 · No fix listed CWE-89
Priority MEDIUM 46
SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01739 · Published 2021-07-12 · No fix listed CWE-89
Priority LOW 34
SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01188 · Published 2021-07-12 · No fix listed CWE-89
Priority LOW 36
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01654 · Published 2021-07-08 · No fix listed CWE-89
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00953 · Published 2021-06-21 · No fix listed CWE-79
Priority MEDIUM 44
MetInfo 7.0 beta is affected by a file modification vulnerability.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02201 · Published 2021-05-24 · No fix listed CWE-22
Load more
THREATIST.IORead the docs