ME
Product
MetInfo
61
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 12High 23Medium 25Low 0
Watch
Add MetInfo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-44849 | 8.8 | Dec 7 | A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account Affected: 7.7 |
| CVE-2020-21126 | 8.8 | Sep 15 | MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo Affected: 7.0.0 |
| CVE-2020-18157 | 8.8 | Jul 30 | Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php Affected: 6.1.3 |
| CVE-2019-17676 | 8.8 | Oct 17 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an… Affected: 7.0.0 |
| CVE-2019-13969 | 8.8 | Jul 19 | Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request Affected: 6.0.0 through 6.2.0 |
| CVE-2017-12789 | 8.8 | May 10 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF) Affected: 5.3.18 |
| CVE-2018-14420 | 8.8 | Jul 20 | MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an… Affected: 6.0.0 |
| CVE-2018-9934 | 8.8 | Apr 10 | The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server… Affected: 6.0.0 |
| CVE-2017-11347 | 8.8 | Jul 17 | Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to… Affected: 5.3.17 |
| CVE-2019-7718 | 8.1 | Feb 11 | An issue was discovered in Metinfo 6.x Affected: 6.0.0 through 6.1.3 |
| CVE-2018-7271 | 8.1 | Feb 21 | An issue was discovered in MetInfo 6.0.0 Affected: 6.0.0 |
| CVE-2018-25439 New | 7.5 | Oct 22 | MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter Affected: 6.0.0 before 6.1.1 |
| CVE-2025-63551 | 7.5 | Nov 6 | A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1 Affected: before 8.1 |
| CVE-2020-20981 | 7.5 | Aug 12 | A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information Affected: 7.0.0 |
| CVE-2020-19304 | 7.5 | Aug 3 | An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information Affected: 7.0.0 |
| CVE-2020-20585 | 7.5 | Jul 8 | A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information Affected: 7.0.0 |
| CVE-2017-11500 | 7.5 | Jul 20 | A directory traversal vulnerability exists in MetInfo 5.3.17 Affected: 5.3.17 |
| CVE-2020-21131 | 7.2 | Jul 12 | SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage Affected: 7.0.0 |
| CVE-2019-17419 | 7.2 | Oct 10 | An issue was discovered in MetInfo 7.0 Affected: 7.0.0 |
| CVE-2019-17418 | 7.2 | Oct 10 | An issue was discovered in MetInfo 7.0 Affected: 7.0.0 |
| CVE-2019-16997 | 7.2 | Sep 30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno… Affected: 7.0.0 |
| CVE-2019-16996 | 7.2 | Sep 30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id… Affected: 7.0.0 |
| CVE-2018-13024 | 7.2 | Jun 29 | Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action Affected: 6.0.0 |
Showing 23