Page 2 of 22 results (0.024 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-18296

https://notcve.org/view.php?id=CVE-2018-18296

15 Oct 2018 — MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action. MetInfo 6.1.2 tiene Cross-Site Scripting (XSS) mediante el parámetro bigclass en /admin/index.php en una acción n=columna=doadd. • http://www.iwantacve.cn/index.php/archives/52 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-17129

https://notcve.org/view.php?id=CVE-2018-17129

17 Sep 2018 — MetInfo 6.1.0 has SQL injection in doexport() in app/system/feedback/admin/feedback_admin.class.php via the class1 field. MetInfo 6.1.0 tiene una inyección SQL en doexport() en app/system/feedback/admin/feedback_admin.class.php mediante el campo class1. • https://github.com/panghusec/exploit/issues/2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-14419

https://notcve.org/view.php?id=CVE-2018-14419

19 Jul 2018 — MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page. MetInfo 6.0.0 permite Cross-Site Scripting (XSS) mediante un nombre modificado de la barra de navegación en la página principal. • https://github.com/AvaterXXX/Metinfo---XSS/blob/master/test • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-14420

https://notcve.org/view.php?id=CVE-2018-14420

19 Jul 2018 — MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI. MetInfo 6.0.0 permite que un ataque Cross-Site Request Forgery (CSRF) añada una cuenta de usuario mediante una acción doaddsave en admin/index.php, tal y como queda demostrado con un URI admin/index.php?anyid=47n=adminc=admin_admina=doaddsave. • https://github.com/AvaterXXX/Metinfo---XSS/blob/master/CSRF • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-13024

https://notcve.org/view.php?id=CVE-2018-13024

29 Jun 2018 — Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor upload action. Metinfo v6.0.0 permite a los atacantes remotos escribir código en un archivo .php y ejecutar ese código a través del parámetro module en admin/column/save.php en una acción de carga del editor. • http://www.kingkk.com/2018/06/Metinfo-v6-0-0-getshell-in-background • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-12530

https://notcve.org/view.php?id=CVE-2018-12530

18 Jun 2018 — An issue was discovered in MetInfo 6.0.0. admin/app/batch/csvup.php allows remote attackers to delete arbitrary files via a flienamecsv=../ directory traversal. This can be exploited via CSRF. Se ha descubierto un problema en MetInfo 6.0.0. admin/app/batch/csvup.php permite que atacantes remotos eliminen archivos arbitrarios mediante un salto de directorio en flienamecsv=../. Esto puede explotarse mediante Cross-Site Request Forgery (CSRF). • https://github.com/summ3rf/Vulner/blob/master/Metinfo.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1

CVE-2018-12531

https://notcve.org/view.php?id=CVE-2018-12531

18 Jun 2018 — An issue was discovered in MetInfo 6.0.0. install\index.php allows remote attackers to write arbitrary PHP code into config_db.php, a different vulnerability than CVE-2018-7271. Se ha descubierto un problema en MetInfo 6.0.0. install\index.php permite que atacantes remotos escriban código PHP arbitrario en config_db.php. Esta vulnerabilidad es diferente de CVE-2018-7271. • https://github.com/summ3rf/Vulner/blob/master/Metinfo.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-9985

https://notcve.org/view.php?id=CVE-2018-9985

10 Apr 2018 — The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. La página principal de MetInfo 6.0 permite Cross-Site Scripting (XSS) mediante el envío de un mensaje de feedback a un administrador. • https://github.com/learnsec6/test/issues/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 2

CVE-2018-9934

https://notcve.org/view.php?id=CVE-2018-9934

10 Apr 2018 — The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to specify a web server under the attacker's control. La característica reset-password en MetInfo 6.0 permite que atacantes remotos cambien contraseñas arbitrarias mediante vectores relacionados con una cabecera de Host HTTP que se modifica para especificar un servidor web bajo el control del atacante. • http://www.cnblogs.com/babers/p/8503116.html •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-9928

https://notcve.org/view.php?id=CVE-2018-9928

10 Apr 2018 — Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en save.php en MetInfo 6.0 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante los parámetros webname o weburl. • https://github.com/Sm1L3ing/xss-in-metinfo/blob/master/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •