Metinfo: >> Metinfo >> 7.0.0 Security Vulnerabilities
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-06-21
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php.
CVSS Score
9.1
EPSS Score
0.009
Published
2021-05-24
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI.
CVSS Score
9.8
EPSS Score
0.005
Published
2020-09-30
app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-10-17
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.
CVSS Score
9.8
EPSS Score
0.007
Published
2019-10-14
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997.
CVSS Score
7.2
EPSS Score
0.928
Published
2019-10-10
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter.
CVSS Score
7.2
EPSS Score
0.003
Published
2019-10-10
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
CVSS Score
7.2
EPSS Score
0.923
Published
2019-09-30
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
CVSS Score
7.2
EPSS Score
0.929
Published
2019-09-30
Page 2