IDCVSSSummaryLast (major) updatePublished
CVE-2019-7718 6.8
An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php
10-02-2019 - 23:29 10-02-2019 - 23:29
CVE-2018-20486 4.3
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
26-12-2018 - 14:29 26-12-2018 - 14:29
CVE-2018-19836 4.3
In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction wi
03-12-2018 - 14:29 03-12-2018 - 14:29
CVE-2018-19835 4.3
Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter.
03-12-2018 - 14:29 03-12-2018 - 14:29
CVE-2018-19051 4.3
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.
06-11-2018 - 23:29 06-11-2018 - 23:29
CVE-2018-19050 4.3
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
06-11-2018 - 23:29 06-11-2018 - 23:29
CVE-2018-18374 3.5
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
15-10-2018 - 21:29 15-10-2018 - 21:29
CVE-2018-18296 4.3
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action.
14-10-2018 - 22:29 14-10-2018 - 22:29
CVE-2018-17129 4.0
MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field.
17-09-2018 - 00:29 17-09-2018 - 00:29
CVE-2018-14420 6.8
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI.
19-07-2018 - 21:29 19-07-2018 - 21:29
CVE-2018-14419 3.5
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
19-07-2018 - 21:29 19-07-2018 - 21:29
CVE-2018-13024 6.5
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action.
29-06-2018 - 13:29 29-06-2018 - 13:29
CVE-2018-12531 7.5
An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
18-06-2018 - 10:29 18-06-2018 - 10:29
CVE-2018-12530 5.8
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.
18-06-2018 - 10:29 18-06-2018 - 10:29
CVE-2018-9985 4.3
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
10-04-2018 - 14:29 10-04-2018 - 14:29
CVE-2018-9934 4.3
The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control.
10-04-2018 - 03:29 10-04-2018 - 03:29
CVE-2018-9928 4.3
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
10-04-2018 - 02:29 10-04-2018 - 02:29
CVE-2018-7721 4.3
Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data.
07-03-2018 - 03:29 07-03-2018 - 03:29
CVE-2018-7271 9.3
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary comman
20-02-2018 - 19:29 20-02-2018 - 19:29
CVE-2017-14513 5.0
Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php.
17-09-2017 - 17:29 17-09-2017 - 17:29
CVE-2017-9764 4.3
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action.
19-07-2017 - 08:29 19-07-2017 - 08:29
CVE-2017-11347 6.5
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
17-07-2017 - 09:18 17-07-2017 - 09:18
CVE-2017-6878 3.5
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php.
29-03-2017 - 10:05 27-03-2017 - 11:59
CVE-2010-4976 4.3
Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third part
13-02-2012 - 23:02 01-11-2011 - 18:55
Back to Top Mark selected
Back to Top