CVE-2020-20907

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/languagegeneral.class.php and app/system/include/function/file.func.php...

CVE-2020-20800

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup=yes=yes=yes URI...

CVE-2020-19304

An issue in /admin/index.php?n=system=filept=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information...

CVE-2020-21127

MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs=index=dodel...

CVE-2020-21133

SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn=dovalid...

CVE-2020-18157

Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...

CVE-2020-21132

SQL Injection vulnerability in Metinfo 7.0.0beta in index.php...

CVE-2020-19305

An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges...

CVE-2020-20981

A SQL injection in the /admin/?n=logs=index=dolist component of Metinfo 7.0 allows attackers to access sensitive database information...

CVE-2020-21126

MetInfo 7.0.0 contains a Cross-Site Request Forgery CSRF via admin/?n=admin=index=doSaveInfo...

CVE-2020-21131

SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language=languageweb=doAddLanguage...

CVE-2020-18175

SQL Injection vulnerability in Metinfo 6.1.3 via a dosafetyemailadd action in basic.php...

CVE-2020-20600

MetInfo 7.0 beta contains a stored cross-site scripting XSS vulnerability in the $name parameter of admin/?n=column=index=doAddColumn...

CVE-2019-17553

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags=index=doSaveTags URI...

CVE-2019-17419

An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user=adminuser=doGetUserInfo id parameter...

CVE-2019-13969

Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset=admin=index=dogettextcontent=lang=1 request...

CVE-2019-17418

An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language=languagegeneral=doSearchParameter appno parameter, a different issue than CVE-2019-16997...

CVE-2018-20486

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/logincheck.php urlarray parameter...

CVE-2017-12788

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...

CVE-2017-11500

A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php...