Vulnerabilities (CVE)

Filtered by vendor Metinfo Subscribe
Filtered by product Metinfo
Total 53 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-12530 1 Metinfo 1 Metinfo 2024-02-28 5.8 MEDIUM 6.5 MEDIUM
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.
CVE-2018-7721 1 Metinfo 1 Metinfo 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data.
CVE-2018-13024 1 Metinfo 1 Metinfo 2024-02-28 6.5 MEDIUM 7.2 HIGH
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action.
CVE-2018-9928 1 Metinfo 1 Metinfo 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
CVE-2018-9934 1 Metinfo 1 Metinfo 2024-02-28 4.3 MEDIUM 8.8 HIGH
The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control.
CVE-2018-7271 1 Metinfo 1 Metinfo 2024-02-28 9.3 HIGH 8.1 HIGH
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell.
CVE-2018-12531 1 Metinfo 1 Metinfo 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
CVE-2017-14513 1 Metinfo 1 Metinfo 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php.
CVE-2017-11347 1 Metinfo 1 Metinfo 2024-02-28 6.5 MEDIUM 8.8 HIGH
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
CVE-2017-9764 1 Metinfo 1 Metinfo 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action.
CVE-2017-11500 1 Metinfo 1 Metinfo 2024-02-28 5.0 MEDIUM 7.5 HIGH
A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php.
CVE-2017-6878 1 Metinfo 1 Metinfo 2024-02-28 3.5 LOW 5.4 MEDIUM
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php.
CVE-2010-4976 1 Metinfo 1 Metinfo 2024-02-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third party information.