CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 24/05/2021 |
| CVE-2020-20800 | CRITICAL9.8 | An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI. | 30/09/2020 |
| CVE-2019-17676 | HIGH8.8 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI. | 17/10/2019 |
| CVE-2019-17553 | CRITICAL9.8 | An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI. | 14/10/2019 |
| CVE-2019-17419 | HIGH7.2 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter. | 10/10/2019 |
| CVE-2019-17418 | HIGH7.2 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997. | 10/10/2019 |
| CVE-2019-16997 | HIGH7.2 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. | 30/09/2019 |
| CVE-2019-16996 | HIGH7.2 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter. | 30/09/2019 |
| CVE-2019-13969 | HIGH8.8 | Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request. | 19/07/2019 |
| CVE-2017-12789 | HIGH8.8 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state. | 10/05/2019 |
| CVE-2017-12790 | MEDIUM6.5 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state. | 09/05/2019 |
| CVE-2017-12788 | MEDIUM6.1 | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter. | 09/05/2019 |
| CVE-2019-7718 | HIGH8.1 | An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.clas | 11/02/2019 |
| CVE-2018-20486 | MEDIUM6.1 | MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | 26/12/2018 |
| CVE-2018-19836 | MEDIUM6.1 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS fi | 03/12/2018 |
| CVE-2018-19835 | MEDIUM6.1 | Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. | 03/12/2018 |
| CVE-2018-19051 | MEDIUM6.1 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | 07/11/2018 |