Metinfo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via tHigh 8.7 · Oct 22, 2026
• CVE-2025-63551 A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS)High 7.5 · Nov 6, 2025
• CVE-2022-44849 A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.High 8.8 · Dec 6, 2022
• CVE-2022-23335 Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.Critical 9.8 · Feb 14, 2022
• CVE-2022-22295 Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.Critical 9.8 · Feb 14, 2022
• CVE-2020-21127 MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.Critical 9.8 · Sep 15, 2021
• CVE-2020-21126 MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.High 8.8 · Sep 15, 2021
• CVE-2020-20981 A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.High 7.5 · Aug 12, 2021
• CVE-2020-19305 An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackerCritical 9.8 · Aug 3, 2021
• CVE-2020-19304 An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive informatHigh 7.5 · Aug 3, 2021
• CVE-2020-18175 SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.Critical 9.8 · Jul 30, 2021
• CVE-2020-18157 Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.High 8.8 · Jul 30, 2021
• CVE-2020-21133 SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.Critical 9.8 · Jul 12, 2021
• CVE-2020-21132 SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.Critical 9.8 · Jul 12, 2021
• CVE-2020-21131 SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.High 7.2 · Jul 12, 2021
• CVE-2020-20585 A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.High 7.5 · Jul 8, 2021
• CVE-2020-20907 MetInfo 7.0 beta is affected by a file modification vulnerability.Critical 9.1 · May 24, 2021
• CVE-2020-20800 An issue was discovered in MetInfo v7.0.0 beta.Critical 9.8 · Sep 30, 2020
• CVE-2019-17676 app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstraHigh 8.8 · Oct 17, 2019
• CVE-2019-17553 An issue was discovered in MetInfo v7.0.0 beta.Critical 9.8 · Oct 14, 2019
• CVE-2019-17419 An issue was discovered in MetInfo 7.0.High 7.2 · Oct 9, 2019
• CVE-2019-17418 An issue was discovered in MetInfo 7.0.High 7.2 · Oct 9, 2019
• CVE-2019-16997 In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExHigh 7.2 · Sep 30, 2019
• CVE-2019-16996 In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_tHigh 7.2 · Sep 30, 2019
• CVE-2019-13969 Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.High 8.8 · Jul 19, 2019