Search
Total
20 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-20600 | 1 Metinfo | 1 Metinfo | 2021-12-23 | 3.5 LOW | 5.4 MEDIUM |
| MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. | |||||
| CVE-2020-21517 | 1 Metinfo | 1 Metinfo | 2021-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php. | |||||
| CVE-2018-12530 | 1 Metinfo | 1 Metinfo | 2020-08-24 | 5.8 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF. | |||||
| CVE-2018-19836 | 1 Metinfo | 1 Metinfo | 2020-08-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter. | |||||
| CVE-2017-12790 | 1 Metinfo | 1 Metinfo | 2019-05-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state. | |||||
| CVE-2017-12788 | 1 Metinfo | 1 Metinfo | 2019-05-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the (1) class1 parameter or the (2) anyid parameter. | |||||
| CVE-2018-20486 | 1 Metinfo | 1 Metinfo | 2019-01-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | |||||
| CVE-2018-19051 | 1 Metinfo | 1 Metinfo | 2018-12-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. | |||||
| CVE-2018-19050 | 1 Metinfo | 1 Metinfo | 2018-12-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. | |||||
| CVE-2018-19835 | 1 Metinfo | 1 Metinfo | 2018-12-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. | |||||
| CVE-2018-18296 | 1 Metinfo | 1 Metinfo | 2018-11-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. | |||||
| CVE-2018-18374 | 1 Metinfo | 1 Metinfo | 2018-11-27 | 3.5 LOW | 5.4 MEDIUM |
| XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter. | |||||
| CVE-2018-17129 | 1 Metinfo | 1 Metinfo | 2018-11-09 | 4.0 MEDIUM | 4.9 MEDIUM |
| MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field. | |||||
| CVE-2018-14419 | 1 Metinfo | 1 Metinfo | 2018-09-14 | 3.5 LOW | 4.8 MEDIUM |
| MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page. | |||||
| CVE-2018-9985 | 1 Metinfo | 1 Metinfo | 2018-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. | |||||
| CVE-2018-9928 | 1 Metinfo | 1 Metinfo | 2018-05-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter. | |||||
| CVE-2018-7721 | 1 Metinfo | 1 Metinfo | 2018-03-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data. | |||||
| CVE-2017-14513 | 1 Metinfo | 1 Metinfo | 2017-09-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fingerprintdo action to admin/app/physical/physical.php. | |||||
| CVE-2017-9764 | 1 Metinfo | 1 Metinfo | 2017-08-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to /include/stat/stat.php in a para action. | |||||
| CVE-2017-6878 | 1 Metinfo | 1 Metinfo | 2017-03-29 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php. | |||||