CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 24/05/2021 |
| CVE-2020-20800 | 严重9.8 | An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndata=yes&endata=yes&showdata=yes URI. | 30/09/2020 |
| CVE-2019-17676 | 高危8.8 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstrated by an admin/?n=admin&c=index&a=doSaveSetup URI. | 17/10/2019 |
| CVE-2019-17553 | 严重9.8 | An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI. | 14/10/2019 |
| CVE-2019-17419 | 高危7.2 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter. | 10/10/2019 |
| CVE-2019-17418 | 高危7.2 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997. | 10/10/2019 |
| CVE-2019-16997 | 高危7.2 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter. | 30/09/2019 |
| CVE-2019-16996 | 高危7.2 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter. | 30/09/2019 |
| CVE-2019-13969 | 高危8.8 | Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request. | 19/07/2019 |
| CVE-2017-12789 | 高危8.8 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state. | 10/05/2019 |
| CVE-2017-12790 | 中危6.5 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state. | 09/05/2019 |
| CVE-2017-12788 | 中危6.1 | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter. | 09/05/2019 |
| CVE-2019-7718 | 高危8.1 | An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.clas | 11/02/2019 |
| CVE-2018-20486 | 中危6.1 | MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | 26/12/2018 |
| CVE-2018-19836 | 中危6.1 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS fi | 03/12/2018 |
| CVE-2018-19835 | 中危6.1 | Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. | 03/12/2018 |
| CVE-2018-19051 | 中危6.1 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | 07/11/2018 |