Filtered by vendor Metinfo
Subscriptions
Filtered by product Metinfo
Subscriptions
Total
53 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-44849 | 1 Metinfo | 1 Metinfo | 2022-12-12 | 8.8 High |
| A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account. | ||||
| CVE-2020-20907 | 2 Metinfo, Microsoft | 2 Metinfo, Windows | 2022-10-05 | 9.1 Critical |
| MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.class.php and app/system/include/function/file.func.php. | ||||
| CVE-2020-19305 | 1 Metinfo | 1 Metinfo | 2022-10-05 | 9.8 Critical |
| An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges. | ||||
| CVE-2017-11500 | 1 Metinfo | 1 Metinfo | 2022-10-03 | 7.5 High |
| A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php. | ||||
| CVE-2017-11347 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php. | ||||
| CVE-2018-13024 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. | ||||
| CVE-2018-20486 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | ||||
| CVE-2018-18374 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. | ||||
| CVE-2018-9934 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control. | ||||
| CVE-2018-19051 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | ||||
| CVE-2018-19050 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. | ||||
| CVE-2019-7718 | 1 Metinfo | 1 Metinfo | 2022-10-03 | N/A |
| An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily. | ||||
| CVE-2022-22295 | 1 Metinfo | 1 Metinfo | 2022-02-22 | 9.8 Critical |
| Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter. | ||||
| CVE-2022-23335 | 1 Metinfo | 1 Metinfo | 2022-02-22 | 9.8 Critical |
| Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter. | ||||
| CVE-2020-20600 | 1 Metinfo | 1 Metinfo | 2021-12-23 | 5.4 Medium |
| MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. | ||||
| CVE-2020-21126 | 1 Metinfo | 1 Metinfo | 2021-09-23 | 8.8 High |
| MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo. | ||||
| CVE-2020-21127 | 1 Metinfo | 1 Metinfo | 2021-09-23 | 9.8 Critical |
| MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel. | ||||
| CVE-2020-20981 | 1 Metinfo | 1 Metinfo | 2021-08-16 | 7.5 High |
| A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information. | ||||
| CVE-2020-19304 | 1 Metinfo | 1 Metinfo | 2021-08-11 | 7.5 High |
| An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information. | ||||
| CVE-2020-18157 | 1 Metinfo | 1 Metinfo | 2021-08-03 | 8.8 High |
| Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php. | ||||