| CVE-2018-19050 | MEDIO6.1 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. | 07/11/2018 |
| CVE-2018-18374 | MEDIO5.4 | XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. | 16/10/2018 |
| CVE-2018-18296 | MEDIO6.1 | MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. | 15/10/2018 |
| CVE-2018-17129 | MEDIO4.9 | MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field. | 17/09/2018 |
| CVE-2018-14420 | ALTO8.8 | MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI. | 20/07/2018 |
| CVE-2018-14419 | MEDIO4.8 | MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page. | 20/07/2018 |
| CVE-2018-13024 | ALTO7.2 | Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. | 29/06/2018 |
| CVE-2018-12531 | CRÍTICO9.8 | An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271. | 18/06/2018 |
| CVE-2018-12530 | MEDIO6.5 | An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF. | 18/06/2018 |
| CVE-2018-9985 | MEDIO6.1 | The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. | 10/04/2018 |
| CVE-2018-9934 | ALTO8.8 | The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control. | 10/04/2018 |
| CVE-2018-9928 | MEDIO6.1 | Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter. | 10/04/2018 |
| CVE-2018-7721 | MEDIO6.1 | Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data. | 07/03/2018 |
| CVE-2018-7271 | ALTO8.1 | An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell. | 21/02/2018 |
| CVE-2017-14513 | MEDIO5.3 | Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. | 17/09/2017 |
| CVE-2017-11500 | ALTO7.5 | A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php. | 20/07/2017 |
| CVE-2017-9764 | MEDIO6.1 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action. | 19/07/2017 |
| CVE-2017-11347 | ALTO8.8 | Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php. | 17/07/2017 |
| CVE-2017-6878 | MEDIO5.4 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php. | 27/03/2017 |
| CVE-2010-4976 | MEDIO4.3 | Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third party information. | 01/11/2011 |