Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
65 results · page 1 of 2
Oct 22, 2026MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via tCVE-2018-25439 · Other software · MetInfo · reported by VulnCheckHigh 8.7
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- MetInfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comweb.archive.org
Apr 1, 2026MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by senCVE-2026-29014 · Other software · MetInfo CMS · reported by VulnCheckCritical 9.3
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
- Product
- MetInfo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.commetinfo.cn
Nov 6, 2025A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS)CVE-2025-63551 · Other software · Metinfo · reported by MITREHigh 7.5
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.CVE-2025-60454 · Other software · Metinfo · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\img_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.CVE-2025-60453 · Other software · Metinfo · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.CVE-2025-60452 · Other software · Metinfo · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\download_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.CVE-2025-60451 · Other software · Metinfo · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0.CVE-2025-60450 · Other software · Metinfo · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.CVE-2022-44849 · Other software · Metinfo · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.CVE-2022-23335 · Other software · Metinfo · reported by MITRECritical 9.8
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Feb 14, 2022Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.CVE-2022-22295 · Other software · Metinfo · reported by MITRECritical 9.8
Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Dec 22, 2021MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.CVE-2020-20600 · Other software · Metinfo · reported by MITREMedium 5.4
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.CVE-2020-21127 · Other software · Metinfo · reported by MITRECritical 9.8
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.CVE-2020-21126 · Other software · Metinfo · reported by MITREHigh 8.8
MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.CVE-2020-20981 · Other software · Metinfo · reported by MITREHigh 7.5
A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackerCVE-2020-19305 · Other software · Metinfo · reported by MITRECritical 9.8
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 3, 2021An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive informatCVE-2020-19304 · Other software · Metinfo · reported by MITREHigh 7.5
An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.CVE-2020-18175 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.CVE-2020-18157 · Other software · Metinfo · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.CVE-2020-21133 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.CVE-2020-21132 · Other software · Metinfo · reported by MITRECritical 9.8
SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.CVE-2020-21131 · Other software · Metinfo · reported by MITREHigh 7.2
SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2021A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.CVE-2020-20585 · Other software · Metinfo · reported by MITREHigh 7.5
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.CVE-2020-21517 · Other software · Metinfo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021MetInfo 7.0 beta is affected by a file modification vulnerability.CVE-2020-20907 · Other software · Metinfo · reported by MITRECritical 9.1
MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Sep 30, 2020An issue was discovered in MetInfo v7.0.0 beta.CVE-2020-20800 · Other software · Metinfo · reported by MITRECritical 9.8
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2019app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstraCVE-2019-17676 · Other software · Metinfo · reported by MITREHigh 8.8
app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019An issue was discovered in MetInfo v7.0.0 beta.CVE-2019-17553 · Other software · Metinfo · reported by MITRECritical 9.8
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019An issue was discovered in MetInfo 7.0.CVE-2019-17419 · Other software · Metinfo · reported by MITREHigh 7.2
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019An issue was discovered in MetInfo 7.0.CVE-2019-17418 · Other software · Metinfo · reported by MITREHigh 7.2
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2019In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExCVE-2019-16997 · Other software · Metinfo · reported by MITREHigh 7.2
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2019In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_tCVE-2019-16996 · Other software · Metinfo · reported by MITREHigh 7.2
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2019Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.CVE-2019-13969 · Other software · Metinfo · reported by MITREHigh 8.8
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2019Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF).CVE-2017-12789 · Other software · Metinfo · reported by MITREHigh 8.8
Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2019Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF).CVE-2017-12790 · Other software · Metinfo · reported by MITREMedium 6.5
Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2019Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the CVE-2017-12788 · Other software · Metinfo · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019An issue was discovered in Metinfo 6.x.CVE-2019-7718 · Other software · Metinfo · reported by MITREHigh 8.1
An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2018MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.CVE-2018-20486 · Other software · Metinfo · reported by MITREMedium 6.1
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.metinfo.cngithub.com
Dec 3, 2018In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variCVE-2018-19836 · Other software · Metinfo · reported by MITREMedium 6.1
In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter.CVE-2018-19835 · Other software · Metinfo · reported by MITREMedium 6.1
Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2018MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.CVE-2018-19051 · Other software · Metinfo · reported by MITREMedium 6.1
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2018MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.CVE-2018-19050 · Other software · Metinfo · reported by MITREMedium 6.1
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2018XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.CVE-2018-18374 · Other software · Metinfo · reported by MITREMedium 5.4
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2018MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.CVE-2018-18296 · Other software · Metinfo · reported by MITREMedium 6.1
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 17, 2018MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.CVE-2018-17129 · Other software · Metinfo · reported by MITREMedium 4.9
MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2018MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admCVE-2018-14420 · Other software · Metinfo · reported by MITREHigh 8.8
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2018MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.CVE-2018-14419 · Other software · Metinfo · reported by MITREMedium 4.8
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor uplCVE-2018-13024 · Other software · Metinfo · reported by MITREHigh 7.2
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2018An issue was discovered in MetInfo 6.0.0.CVE-2018-12531 · Other software · Metinfo · reported by MITRECritical 9.8
An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2018An issue was discovered in MetInfo 6.0.0.CVE-2018-12530 · Other software · Metinfo · reported by MITREMedium 6.5
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.
- Product
- Metinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.