Filtered by vendor Metinfo
Subscriptions
Total
53 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-18374 | 1 Metinfo | 1 Metinfo | 2024-09-17 | N/A |
| XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. | ||||
| CVE-2019-7718 | 1 Metinfo | 1 Metinfo | 2024-09-17 | N/A |
| An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=<?php and admin/databack/bakup_tables.php?2=file_put_contents URIs because app/system/databack/admin/index.class.php creates bakup_tables.php temporarily. | ||||
| CVE-2018-13024 | 1 Metinfo | 1 Metinfo | 2024-09-17 | N/A |
| Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. | ||||
| CVE-2018-9934 | 1 Metinfo | 1 Metinfo | 2024-09-17 | N/A |
| The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control. | ||||
| CVE-2018-19050 | 1 Metinfo | 1 Metinfo | 2024-09-16 | N/A |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. | ||||
| CVE-2018-19051 | 1 Metinfo | 1 Metinfo | 2024-09-16 | N/A |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | ||||
| CVE-2017-11500 | 1 Metinfo | 1 Metinfo | 2024-09-16 | 7.5 High |
| A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php. | ||||
| CVE-2017-11347 | 1 Metinfo | 1 Metinfo | 2024-09-16 | N/A |
| Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php. | ||||
| CVE-2018-20486 | 1 Metinfo | 1 Metinfo | 2024-09-16 | N/A |
| MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | ||||
| CVE-2010-4976 | 1 Metinfo | 1 Metinfo | 2024-08-07 | N/A |
| Cross-site scripting (XSS) vulnerability in search/search.php in MetInfo 3.0 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter (aka Search Box field). NOTE: some of these details are obtained from third party information. | ||||
| CVE-2017-14513 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. | ||||
| CVE-2017-12788 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter. | ||||
| CVE-2017-12790 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state. | ||||
| CVE-2017-12789 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state. | ||||
| CVE-2017-9764 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action. | ||||
| CVE-2017-6878 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php. | ||||
| CVE-2018-19835 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. | ||||
| CVE-2018-19836 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter. | ||||
| CVE-2018-18296 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. | ||||
| CVE-2018-17129 | 1 Metinfo | 1 Metinfo | 2024-08-05 | N/A |
| MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field. | ||||