ME
Product
MetInfo
61
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 12High 23Medium 25Low 0
Watch
Add MetInfo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29014 | 9.8 | Apr 1 | MetInfo CMS Unauthenticated PHP Code Injection RCE Affected: 7.9; 8.0.0; 8.1 |
| CVE-2022-23335 | 9.8 | Feb 14 | Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter Affected: 7.5.0 |
| CVE-2022-22295 | 9.8 | Feb 14 | Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter Affected: 7.5.0 |
| CVE-2020-21127 | 9.8 | Sep 15 | MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel Affected: 7.0.0 |
| CVE-2020-19305 | 9.8 | Aug 3 | An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate… Affected: 7.0.0 |
| CVE-2020-18175 | 9.8 | Jul 30 | SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php Affected: 6.1.3 |
| CVE-2020-21133 | 9.8 | Jul 12 | SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid Affected: 7.0.0 |
| CVE-2020-21132 | 9.8 | Jul 12 | SQL Injection vulnerability in Metinfo 7.0.0beta in index.php Affected: 7.0.0 |
| CVE-2020-20800 | 9.8 | Sep 30 | An issue was discovered in MetInfo v7.0.0 beta Affected: 7.0.0 |
| CVE-2019-17553 | 9.8 | Oct 14 | An issue was discovered in MetInfo v7.0.0 beta Affected: 7.0.0 |
| CVE-2018-12531 | 9.8 | Jun 18 | An issue was discovered in MetInfo 6.0.0 Affected: 6.0.0 |
| CVE-2020-20907 | 9.1 | May 24 | MetInfo 7.0 beta is affected by a file modification vulnerability Affected: 7.0.0 |
| CVE-2022-44849 | 8.8 | Dec 7 | A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account Affected: 7.7 |
| CVE-2020-21126 | 8.8 | Sep 15 | MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo Affected: 7.0.0 |
| CVE-2020-18157 | 8.8 | Jul 30 | Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php Affected: 6.1.3 |
| CVE-2019-17676 | 8.8 | Oct 17 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an… Affected: 7.0.0 |
| CVE-2019-13969 | 8.8 | Jul 19 | Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request Affected: 6.0.0 through 6.2.0 |
| CVE-2017-12789 | 8.8 | May 10 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF) Affected: 5.3.18 |
| CVE-2018-14420 | 8.8 | Jul 20 | MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an… Affected: 6.0.0 |
| CVE-2018-9934 | 8.8 | Apr 10 | The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server… Affected: 6.0.0 |
| CVE-2017-11347 | 8.8 | Jul 17 | Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to… Affected: 5.3.17 |
| CVE-2019-7718 | 8.1 | Feb 11 | An issue was discovered in Metinfo 6.x Affected: 6.0.0 through 6.1.3 |
| CVE-2018-7271 | 8.1 | Feb 21 | An issue was discovered in MetInfo 6.0.0 Affected: 6.0.0 |
| CVE-2018-25439 | 7.5 | Oct 22 | MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter Affected: 6.0.0 before 6.1.1 |
| CVE-2025-63551 | 7.5 | Nov 6 | A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1 Affected: before 8.1 |
| CVE-2020-20981 | 7.5 | Aug 12 | A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information Affected: 7.0.0 |
| CVE-2020-19304 | 7.5 | Aug 3 | An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information Affected: 7.0.0 |
| CVE-2020-20585 | 7.5 | Jul 8 | A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information Affected: 7.0.0 |
| CVE-2017-11500 | 7.5 | Jul 20 | A directory traversal vulnerability exists in MetInfo 5.3.17 Affected: 5.3.17 |
| CVE-2020-21131 | 7.2 | Jul 12 | SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage Affected: 7.0.0 |
| CVE-2019-17419 | 7.2 | Oct 10 | An issue was discovered in MetInfo 7.0 Affected: 7.0.0 |
| CVE-2019-17418 | 7.2 | Oct 10 | An issue was discovered in MetInfo 7.0 Affected: 7.0.0 |
| CVE-2019-16997 | 7.2 | Sep 30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno… Affected: 7.0.0 |
| CVE-2019-16996 | 7.2 | Sep 30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id… Affected: 7.0.0 |
| CVE-2018-13024 | 7.2 | Jun 29 | Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action Affected: 6.0.0 |
| CVE-2017-12790 | 6.5 | May 9 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF) Affected: 5.3.18 |
| CVE-2018-12530 | 6.5 | Jun 18 | An issue was discovered in MetInfo 6.0.0 Affected: 6.0.0 |
| CVE-2025-60452 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60453 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60450 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60454 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60451 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2020-21517 | 6.1 | Jun 21 | Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php Affected: 7.0.0 |
| CVE-2017-12788 | 6.1 | May 9 | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1… Affected: 5.3.18 |
| CVE-2018-20486 | 6.1 | Dec 26 | MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter Affected: 6.0.0 through 6.1.3 |
| CVE-2018-19836 | 6.1 | Dec 3 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the… Affected: 6.1.3 |
| CVE-2018-19835 | 6.1 | Dec 3 | Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter Affected: 6.1.3 |
| CVE-2018-19051 | 6.1 | Nov 7 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter Affected: 6.1.3 |
| CVE-2018-19050 | 6.1 | Nov 7 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter Affected: 6.1.3 |
| CVE-2018-18296 | 6.1 | Oct 15 | MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action Affected: 6.1.2 |