MetInfo CMS <= 8.1 - Remote Code Execution

MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests. id: CVE-2026-29014 info: name: MetInfo CMS = 8....

Metinfo 7.0.0 beta - SQL Injection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter. id: CVE-2019-16996 info: name: Metinfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description:...

Metinfo 7.0.0 beta - SQL Injection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter. id: CVE-2019-16997 info: name: Metinfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description:...

MetInfo 7.0.0 beta - SQL Injection

MetInfo 7.0.0 beta is susceptible to SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter a different issue than CVE-2019-16997. id: CVE-2019-17418 info: name: MetInfo 7.0.0 beta - SQL Injection author: ritikchaddha severity: high description: | MetInfo...

CVE-2018-25439

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

EUVD-2018-21963

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

CVE-2018-25439

MetInfo CMS versions 6.0.0 before 6.1.1 are vulnerable to a path traversal vulnerability in the /include/thumb.php component. The root cause is an inadequate filter where attackers can use backslash sequences to bypass the str_replace function, allowing unauthenticated remote attackers to read ar...

VulnCheck KEV: CVE-2018-25439

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like...

Exploit for CVE-2026-109618

Lab RCE PHP 2026 — RCE yang viral, direplikasi & diuji secara...

Metinfo-6.1.2-SQL-injection

Metinfo-6.1.2-SQL-injection Metinfo 6.1.2 SQL injection script 0-sec.org...

Metinfo 7.0.0 beta - SQL Injection Detection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Metinfo 7.""" from kittysploit import from lib.protocols.http.httpclie...

MetInfo <=6.1.0 - Local File Inclusion Detection

MetInfo 6.0.0 through 6.1.0 is vulnerable to local file inclusion and allows remote unauthenticated attackers access to locally stored files and their content. !/usr/bin/env python3 -- coding: utf-8 -- """MetInfo 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Metinfo CMS Code Execution

The vulnerability of the wxAdminLogin function in the Metinfo CMS system is related to incorrect code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Changsha Metinfo Information Technology Co., Ltd. has a SQL injection vulnerability

MetInfo is an open-source CMS enterprise website building system that can be used for commercial websites without violating licensing agreements. Changsha Mitop Information Technology Co., Ltd.'s MetInfo has a SQL injection vulnerability, and attackers can exploit this vulnerability to access...

MetInfo weixinreply command injection

Added: 05/07/2026 Background MetInfo is an open-source content management system CMS written in PHP and MySQL developed in China. Problem A vulnerability in the weixinreply class allows remote attackers to execute arbitrary commands by sending an API request with specially crafted EventKey and...

MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks

Threat actors are actively exploiting a critical security flaw impacting an open-source content management system CMS known as MetInfo, according to new findings from VulnCheck. The vulnerability in question is CVE-2026-29014 CVSS score: 9.8, a code injection flaw that could result in arbitrary...

VulnCheck KEV: CVE-2026-29014

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...

MetInfo CMS 8.1 WeChat Module Vulnerability Detection Scanner

This Metasploit auxiliary module is a non-exploit vulnerability detection scanner designed to assess potential security weaknesses in the MetInfo CMS WeChat module, specifically related to weixinreply.class.php handling logic...

📄 MetInfo CMS 8.1 Shell Upload Mass Exploiter

This Python module is a mass exploitation framework designed to automate the testing and exploitation of multiple MetInfo CMS targets potentially affected by CVE-2026-29014...

📄 MetInfo CMS 8.1 PHP Code Injection

This Python script is a full remote code execution exploit suite targeting a vulnerability in MetInfo CMS versions 8.1 and below. The flaw resides in the weixin module handling logic, where improperly sanitized input allows PHP code injection via crafted XML and HTTP parameters/headers...