Vulnerabilities

TI-2017-08675 CVE-2017-11718 · GHSA-w47q-3fhm-chgw

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.

LOW 28

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00658 Published 2017-07-28 No fix listed CWE-601

TI-2017-08674 CVE-2017-11717 · GHSA-w8c7-vvc9-5284

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it…

LOW 35

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated b…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01238 Published 2017-07-28 No fix listed CWE-290

TI-2017-08673 CVE-2017-11716 · GHSA-3hgq-g7f9-2qxc

MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.

LOW 28

MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00652 Published 2017-07-28 No fix listed CWE-79

TI-2017-08672 CVE-2017-11715 · GHSA-rx39-82vr-xg3p

job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not…

MEDIUM 45

job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01492 Published 2017-07-28 No fix listed CWE-94

Vulnerabilities

Filters

There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it…

MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.

job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not…