CVE-2018-9934

The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control...

CVE-2018-9934

Summary: CVE-2018-9934 affects MetInfo 6.0, where the reset-password feature can be abused by an attacker who manipulates the Host HTTP header to point to a controlled web server, enabling arbitrary password changes. The vulnerability is contextually described as a network‑level issue with plausi...

CVE-2018-9928

Cross-site scripting XSS vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter...

CVE-2018-9928

Cross-site scripting XSS vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter...

CVE-2018-9928

CVE-2018-9928 is a Cross-site scripting (XSS) vulnerability in MetInfo 6.0, located in save.php, allowing remote attackers to inject arbitrary script via the webname or weburl parameters. Affected software: MetInfo 6.0 (save.php). Root cause: unsanitized user input in webname/weburl leading to sc...

CVE-2018-9928

Cross-site scripting XSS vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2018-08331)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in the save.php file in MetInfo version 6.0. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML...

MetInfo Arbitrary Password Change Vulnerability

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. The reset password function in MetInfo 6.0 has an arbitrary password change...

MetInfo 6.0.0代码执行漏洞（后台直接拿shell）

...

CVE-2018-7721

Cross Site Scripting XSS exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data...

Cross site scripting

Cross Site Scripting XSS exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data...

CVE-2018-7721

Cross Site Scripting XSS exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data...

CVE-2018-7721

CVE-2018-7721 is an XSS vulnerability in MetInfo 6.0.0. The issue lies in /feedback/index.php where input data is mishandled by app/system/feedback/web/feedback.class.php, enabling cross-site scripting. NVD metrics assign CVSSv3 base score 6.1 (MEDIUM) with NETWORK attack vector, LOW attack compl...

CVE-2018-7721

Cross Site Scripting XSS exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data...

XSS vulnerability in metinfo version 6.0.0

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo version 6.0.0. The vulnerability occurs because app/system/feedback/web/feedback.class.php fails to properly handle input data. An attacker can exploit this vulnerabili...

MetInfo config/config_db.php file arbitrary command execution vulnerability

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A security vulnerability exists in MetInfo version 6.0.0, which stems from sloppy filtering of the configuration file in the config/configdb.php file. An attacker can exploit the...

CVE-2018-7271

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...

Design/Logic Flaw

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/configdb.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell...

CVE-2018-7271

CVE-2018-7271 affects MetInfo 6.0.0. In the installer (install/install.php), the config/config_db.php filtering during installation is insufficient, allowing an attacker to inject malicious code and potentially execute arbitrary commands or obtain a web shell. The root cause is sloppy filtering o...