Browse CVEs

HIGH 7.2 CVE-2019-16997EPSS 49% In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_gen… Metinfo No fix yet Fix from $1,9502019-09-30 HIGH 8.8 CVE-2019-13969 Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request. Metinfo after 6.2.0 Fix from $1,9502019-07-19 HIGH 8.8 CVE-2017-12789 Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/o… Metinfo No fix yet Fix from $1,9502019-05-10 MEDIUM 6.5 CVE-2017-12790 Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. … Metinfo No fix yet Fix from $1,6002019-05-09 MEDIUM 6.1 CVE-2017-12788 Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HT… Metinfo No fix yet Fix from $1,6002019-05-09 HIGH 8.1 CVE-2019-7718 An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP co… Metinfo after 6.1.3 Fix from $1,9502019-02-11 MEDIUM 6.1 CVE-2018-20486 MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. Metinfo after 6.1.3 Fix from $1,6002018-12-26 MEDIUM 6.1 CVE-2018-19835 Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. Metinfo No fix yet Fix from $1,6002018-12-03 MEDIUM 6.1 CVE-2018-19836 In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows regis… Metinfo No fix yet Fix from $1,6002018-12-03 MEDIUM 6.1 CVE-2018-19050 MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. Metinfo No fix yet Fix from $1,6002018-11-07 MEDIUM 6.1 CVE-2018-19051 MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. Metinfo No fix yet Fix from $1,6002018-11-07 MEDIUM 5.4 CVE-2018-18374 XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. Metinfo No fix yet Fix from $1,6002018-10-16 MEDIUM 6.1 CVE-2018-18296 MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. Metinfo No fix yet Fix from $1,6002018-10-15 HIGH 8.8 CVE-2018-14420 MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=… Metinfo No fix yet Fix from $1,9502018-07-20 HIGH 7.2 CVE-2018-13024 Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an… Metinfo No fix yet Fix from $1,9502018-06-29 CRITICAL 9.8 CVE-2018-12531 An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulne… Metinfo No fix yet Fix from $2,3002018-06-18 MEDIUM 6.5 CVE-2018-12530 An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory… Metinfo No fix yet Fix from $1,6002018-06-18 MEDIUM 6.1 CVE-2018-9985 The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. Metinfo No fix yet Fix from $1,6002018-04-10 HIGH 8.8 CVE-2018-9934 The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modi… Metinfo No fix yet Fix from $1,9502018-04-10 MEDIUM 6.1 CVE-2018-9928 Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or… Metinfo Mitigation only Fix from $1,6002018-04-10 MEDIUM 6.1 CVE-2018-7721 Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data. Metinfo No fix yet Fix from $1,6002018-03-07 HIGH 8.1 CVE-2018-7271 An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering i… Metinfo No fix yet Fix from $1,9502018-02-21 MEDIUM 5.3 CVE-2017-14513 Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter… Metinfo No fix yet Fix from $1,6002017-09-17 HIGH 7.5 CVE-2017-11500 A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /a… Metinfo No fix yet Fix from $1,9502017-07-20 MEDIUM 6.1 CVE-2017-9764 Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forw… Metinfo No fix yet Fix from $1,6002017-07-19 HIGH 8.8 CVE-2017-11347 Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a ma… Metinfo Mitigation only Fix from $1,9502017-07-17 MEDIUM 5.4 CVE-2017-6878 Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 pa… Metinfo No fix yet Fix from $1,6002017-03-27