693 matches found
CVE-2018-14420
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
Code injection
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...
Cross site request forgery (csrf)
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
MetInfo Cross-Site Request Forgery Vulnerability (CNVD-2018-14101)
MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site request forgery vulnerability exists in MetInfo version 6.0.0. The vulnerability can be exploited by a remote attacker to add a user account via the doaddsave operation...
MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-14100)
MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in MetInfo version 6.0.0. A remote attacker can inject arbitrary script or HTML by modifying the name of the navigation bar on the homepag...
CVE-2018-14419
CVE-2018-14419 affects MetInfo 6.0.0, a PHP/MySQL CMS, where an XSS vulnerability is triggered by modifying the navigation bar name on the home page. The CVSS scores indicate a Network attack vector with low (v2) to medium (v3) impact and user interaction not required on v2 but UI interaction on ...
CVE-2018-14419
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page...
CVE-2018-14420
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
CVE-2018-14420
MetInfo 6.0.0 is vulnerable to Cross‑Site Request Forgery (CSRF) that allows an attacker to add a user account via a doaddsave action in admin/index.php (example URI: admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave). The root cause is CSRF protection absence for state-changing requests...
Metinfo Remote Code Execution Vulnerability
MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A security vulnerability exists in Metinfo version 6.0.0. A remote attacker can exploit the vulnerability by sending the 'module' parameter to the admin/column/save.php file to write...
Arbitrary File Read Vulnerability in Metinfo Version 6.0.0 (Patch Bypass)
MetInfo is a content management system developed using PHP and Mysql. An arbitrary file read vulnerability exists in Metinfo version 6.0.0. An attacker can exploit the vulnerability to read sensitive files on a website bypassing previous patches...
Deserialization of untrusted data
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
CVE-2018-13024
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
CVE-2018-13024
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
CVE-2018-13024
Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action...
CVE-2018-13024
MetInfo v6.0.0 is affected by a remote code execution vulnerability that allows an attacker to write PHP code to a file via the module parameter to admin/column/save.php in an editor upload action. Affected component: MetInfo CMS, version 6.0.0. The underlying issue is the ability to write to a ....
MetInfo Cross-Site Request Forgery Vulnerability (CNVD-2018-11843)
MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site request forgery vulnerability exists in the admin/app/batch/csvup.php file in MetInfo version 6.0.0. A remote attacker can exploit this vulnerability with the help of a...
CVE-2018-12530
An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF...