ME
Product
MetInfo
61
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 12High 23Medium 25Low 0
Watch
Add MetInfo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12790 | 6.5 | May 9 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF) Affected: 5.3.18 |
| CVE-2018-12530 | 6.5 | Jun 18 | An issue was discovered in MetInfo 6.0.0 Affected: 6.0.0 |
| CVE-2025-60452 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60453 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60450 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60454 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2025-60451 | 6.1 | Oct 3 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0 Affected: 8.0.0 |
| CVE-2020-21517 | 6.1 | Jun 21 | Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php Affected: 7.0.0 |
| CVE-2017-12788 | 6.1 | May 9 | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1… Affected: 5.3.18 |
| CVE-2018-20486 | 6.1 | Dec 26 | MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter Affected: 6.0.0 through 6.1.3 |
| CVE-2018-19836 | 6.1 | Dec 3 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the… Affected: 6.1.3 |
| CVE-2018-19835 | 6.1 | Dec 3 | Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter Affected: 6.1.3 |
| CVE-2018-19051 | 6.1 | Nov 7 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter Affected: 6.1.3 |
| CVE-2018-19050 | 6.1 | Nov 7 | MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter Affected: 6.1.3 |
| CVE-2018-18296 | 6.1 | Oct 15 | MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action Affected: 6.1.2 |
| CVE-2018-9985 | 6.1 | Apr 10 | The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator Affected: 6.0.0 |
| CVE-2018-9928 | 6.1 | Apr 10 | Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter Affected: 6.0.0 |
| CVE-2018-7721 | 6.1 | Mar 7 | Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data Affected: 6.0.0 |
| CVE-2017-9764 | 6.1 | Jul 19 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to… Affected: 5.3.17 |
| CVE-2020-20600 | 5.4 | Dec 22 | MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn Affected: 7.0.0 |
| CVE-2018-18374 | 5.4 | Oct 16 | XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter Affected: 6.1.2 |
| CVE-2017-6878 | 5.4 | Mar 27 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to… Affected: 5.3.15 |
| CVE-2017-14513 | 5.3 | Sep 17 | Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to… Affected: 5.3.17 |
| CVE-2018-17129 | 4.9 | Sep 17 | MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field Affected: 6.1.0 |
| CVE-2018-14419 | 4.8 | Jul 20 | MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page Affected: 6.0.0 |
Showing 25