Metinfo: >> Metinfo Security Vulnerabilities
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
CVSS Score
9.3
EPSS Score
0.395
Published
2026-04-01
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
CVSS Score
8.8
EPSS Score
0.004
Published
2022-12-07
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
CVSS Score
9.8
EPSS Score
0.016
Published
2022-02-14
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
CVSS Score
9.8
EPSS Score
0.016
Published
2022-02-14
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-12-22
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
CVSS Score
9.8
EPSS Score
0.016
Published
2021-09-15
MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
CVSS Score
8.8
EPSS Score
0.006
Published
2021-09-15
A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
CVSS Score
7.5
EPSS Score
0.013
Published
2021-08-12
An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
CVSS Score
7.5
EPSS Score
0.019
Published
2021-08-03
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
CVSS Score
9.8
EPSS Score
0.021
Published
2021-08-03
Page 1