Vulnerabilities (CVE)

Vendor filter

Metinfo Subscribe

Filter

32 total CVE
CVE Vendors Products Updated CVSS
CVE-2018-14420 1 Metinfo 1 Metinfo 2018-09-14 6.8
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI.
CVE-2018-13024 1 Metinfo 1 Metinfo 2018-08-24 6.5
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action.
CVE-2018-12531 1 Metinfo 1 Metinfo 2018-08-13 7.5
An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271.
CVE-2018-12530 1 Metinfo 1 Metinfo 2018-08-10 5.8
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF.
CVE-2018-9985 1 Metinfo 1 Metinfo 2018-05-15 4.3
The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
CVE-2018-9928 1 Metinfo 1 Metinfo 2018-05-11 4.3
Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
CVE-2018-7721 1 Metinfo 1 Metinfo 2018-03-26 4.3
Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data.
CVE-2018-7271 1 Metinfo 1 Metinfo 2018-03-21 9.3
An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary...
CVE-2017-14513 1 Metinfo 1 Metinfo 2017-09-21 5.0
Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php.
CVE-2010-4976 1 Metinfo 1 Metinfo 2017-08-29 4.3
Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third...
CVE-2017-9764 1 Metinfo 1 Metinfo 2017-08-07 4.3
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action.
CVE-2017-6878 1 Metinfo 1 Metinfo 2017-03-29 3.5
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php.