CVE-2018-19835

Metinfo 6.1.3 has reflected XSS via the admin/column/move.php langcolumnerr4 parameter...

CVE-2018-19836

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers including the Cookie header, and common.inc.php allows registering variables from the $COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such ...

CVE-2018-19835

CVE-2018-19835 affects MetInfo 6.1.3, with a reflected XSS in the admin/column/move.php parameter lang_columnerr4. The root cause is unsanitized input in that parameter, enabling an attacker to inject arbitrary script/HTML. Documented impact is reflected XSS; CVSS data (NVD) shows MEDIUM overall,...

CVE-2018-19836

MetInfo 6.1.3 is affected by CVE-2018-19836. The vulnerability stems from include/interface/applogin.php allowing arbitrary HTTP header manipulation (including Cookie) and common.inc.php registering variables from $_COOKIE. This combination can enable an attacker to influence request headers and ...

MetInfo pa***.php file has sql injection vulnerability

MetInfo is a content management system developed using PHP and Mysql. A sql injection vulnerability exists in the MetInfo pa.php file, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in MetInfo fe***.php File

MetInfo is a content management system developed using PHP and Mysql. A SQL injection vulnerability exists in the MetInfo fe.php file. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in MetInfo la***.php File

MetInfo is a content management system developed using PHP and Mysql. A sql injection vulnerability exists in the MetInfo la.php file, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in MetInfo Version 6.1.3

MetInfo is a content management system developed using PHP and Mysql. A SQL injection vulnerability exists in MetInfo version 6.1.3. An attacker can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in MetInfo 6.1.3

MetInfo is a content management system developed using PHP and Mysql. A SQL injection vulnerability exists in MetInfo 6.1.3, which can be exploited by attackers to obtain sensitive information...

CVE-2018-19051

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-19050

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

Design/Logic Flaw

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19050

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19051

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

Design/Logic Flaw

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-19051

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-19050

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19050

CVE-2018-19050 affects MetInfo 6.1.3, with a cross-site scripting vulnerability exposed via the admin/index.php?a=dogetpassword langset parameter. The issue is documented across multiple sources (NVD, Red Hat, CVE records) and is categorized with CVSS v2 base score 4.3 (Medium) and CVSS v3 base s...

CVE-2018-19051

MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-09129)

MetInfo is a Content Management System CMS developed using PHP and Mysql. MetInfo 6.1.3 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the admin/index.php?a=dogetpassword langset parameter to conduct a cross-site scripting attack...