Approved changes feed: RSS · Atom
cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Metinfo (1999263b-84e8-5e08-bcdf-9aa589e5d114) |
|---|---|
| Product | Metinfo (30736aac-abc8-5329-a46a-a3d0d37b7942) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/metinfo/metinfo |
purl2cpe | 2026-06-01 10:16:05.089630 |
pkg:github/source-hunter/metinfo |
purl2cpe | 2026-06-01 10:16:05.089633 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-25439 |
vulnerable | 2026-11-03 10:52:12.729646 |
MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
HIGH (7.5)
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Published: 2026-10-22T10:57:26.044Z
Updated: 2026-10-29T11:09:34.251Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63551 |
vulnerable | 2026-06-08 07:39:17.660217 |
Details available
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.
Published: 2025-11-06T00:00:00.000Z
Updated: 2025-11-07T15:11:56.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-7718 |
vulnerable | 2026-06-08 05:14:14.675191 |
Details available
An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily.
Published: 2019-02-11T03:00:00.000Z
Updated: 2024-09-17T03:59:13.018Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13969 |
vulnerable | 2026-06-08 05:12:52.888940 |
Details available
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.
Published: 2019-07-19T05:32:00.000Z
Updated: 2024-08-05T00:05:44.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20486 |
vulnerable | 2026-06-08 05:11:27.429128 |
Details available
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
Published: 2018-12-26T19:00:00.000Z
Updated: 2024-09-16T18:03:38.176Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.