GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    3 vulnerabilities by Metinfo Cms

    GCVE-1988-2026-0274

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 13:49
    VLAI
    Title
    [KIS-2026-06] MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability
    Summary
    --------------------------------------------------------------------------- MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability --------------------------------------------------------------------------- [-] Software Link: https://www.metinfo.cn [-] Affected Versions: Versions 7.9, 8.0, and 8.1. [-] Vulnerability Description: The vulnerable code is located into the /app/system/weixin/include/class/weixinreply.class.php script. Specifically, within the weixinreply::wxAdminLogin() method: 149. public function wxAdminLogin($data = array(),$code = '') 150. { 151. global $_M; 152. $weixinapi = load::mod_class('weixin/weixinapi','new'); 153. $login_code = cache::get("weixin/".$code); 154. if ($login_code) { 155. cache::put("weixin/".$login_code,$data['FromUserName']); 156. } 157. return; 158. } User input passed through the "EventKey" and "FromUserName" XML tags from the HTTP request body when dispatching weixin API requests is not properly sanitized before being used in a call to the cache::get() and cache::put() methods respectively. Specifically, the $code parameter may include Path Traversal sequences, making the cache::get() method into including arbitrary PHP files. This can be abused to set the $login_code variable to the "Array" string by including an arbitrary cache file. Subsequently, the cache::put() method will write the "FromUserName" parameter into the /cache/weixin/Array.php file, embedding it within double quotes: 30. public static function put($file, $data, $type = 'php') 31. { 32. global $_M; 33. 34. load::sys_func('file'); 35. $save = PATH_CACHE . $file . '.' . $type; 36. makefile($save); 37. #$data = str_replace(array("\"", "\\"), array("\\\"", "\\\\"), $data); 38. if (!is_array($data)) { 39. file_put_contents($save, "<?php\ndefined('IN_MET') or exit('No permission');\n\$cache=\"{$data}\";\n?>"); 40. } else { 41. $info = var_export($data, true); 42. $info = "<?php\ndefined('IN_MET') or exit('No permission');\n\$cache = {$info};\n?>"; 43. file_put_contents($save, $info); 44. } 45. } This can be exploited by remote, unauthenticated attackers to inject and execute arbitrary PHP code by abusing PHP's complex curly syntax, leading to unauthenticated Remote Code Execution (RCE). NOTE: when MetInfo is running on non-Windows servers, successful exploitation of this vulnerability requires the /cache/weixin/ directory to exist, which is created when installing and configuring the official WeChat plugin. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2026-29014.php [-] Solution: No official solution is currently available. [-] Disclosure Timeline: [26/02/2026] - Vendor contacted through several @metinfo.cn and @mituo.cn email addresses, no response [07/03/2026] - Tried to reach out to the vendor again, no response [28/03/2026] - Tried to reach out to the vendor once again, no response [29/03/2026] - Tried to reach out to the vendor through Weibo, no response [30/03/2026] - CVE identifier requested [31/03/2026] - CVE identifier assigned [01/04/2026] - Public disclosure [-] CVE Reference: CVE-2026-29014 has been assigned to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2026-06 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Impacted products
    Vendor Product Version
    Metinfo Cms MetInfo CMS Affected: unknown
    Create a notification for this product.
    Relationships
    reference GCVE-1988-2026-0274 (this record)

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "product": "MetInfo CMS",
              "vendor": "Metinfo Cms",
              "versions": [
                {
                  "status": "affected",
                  "version": "unknown"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Egidio Romano"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "---------------------------------------------------------------------------\nMetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.metinfo.cn\n\n\n[-] Affected Versions:\n\nVersions 7.9, 8.0, and 8.1.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located into the\n/app/system/weixin/include/class/weixinreply.class.php script.\n\nSpecifically, within the weixinreply::wxAdminLogin() method:\n\n149.     public function wxAdminLogin($data = array(),$code = \u0027\u0027)\n150.     {\n151.         global $_M;\n152.         $weixinapi = load::mod_class(\u0027weixin/weixinapi\u0027,\u0027new\u0027);\n153.         $login_code = cache::get(\"weixin/\".$code);\n154.          if ($login_code) {\n155.             cache::put(\"weixin/\".$login_code,$data[\u0027FromUserName\u0027]);\n156.          }\n157.         return;\n158.     }\n\nUser input passed through the \"EventKey\" and \"FromUserName\" XML tags\nfrom the HTTP request body when dispatching weixin API requests is not\nproperly sanitized before being used in a call to the cache::get() and\ncache::put() methods respectively.\n\nSpecifically, the $code parameter may include Path Traversal\nsequences, making the cache::get() method into including arbitrary PHP\nfiles. This can be abused to set the $login_code variable to the\n\"Array\" string by including an arbitrary cache file. Subsequently, the\ncache::put() method will write the \"FromUserName\" parameter into the\n/cache/weixin/Array.php file, embedding it within double quotes:\n\n30.     public static function put($file, $data, $type = \u0027php\u0027)\n31.     {\n32.         global $_M;\n33.\n34.         load::sys_func(\u0027file\u0027);\n35.         $save = PATH_CACHE . $file . \u0027.\u0027 . $type;\n36.         makefile($save);\n37.         #$data = str_replace(array(\"\\\"\", \"\\\\\"), array(\"\\\\\\\"\",\n\"\\\\\\\\\"), $data);\n38.         if (!is_array($data)) {\n39.             file_put_contents($save, \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or\nexit(\u0027No permission\u0027);\\n\\$cache=\\\"{$data}\\\";\\n?\u003e\");\n40.         } else {\n41.             $info = var_export($data, true);\n42.             $info = \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or exit(\u0027No\npermission\u0027);\\n\\$cache = {$info};\\n?\u003e\";\n43.             file_put_contents($save, $info);\n44.         }\n45.     }\n\nThis can be exploited by remote, unauthenticated attackers to inject\nand execute arbitrary PHP code by abusing PHP\u0027s complex curly syntax,\nleading to unauthenticated Remote Code Execution (RCE).\n\nNOTE: when MetInfo is running on non-Windows servers, successful\nexploitation of this vulnerability requires the /cache/weixin/\ndirectory to exist, which is created when installing and configuring\nthe official WeChat plugin.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-29014.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[26/02/2026] - Vendor contacted through several @metinfo.cn and\n@mituo.cn email addresses, no response\n\n[07/03/2026] - Tried to reach out to the vendor again, no response\n\n[28/03/2026] - Tried to reach out to the vendor once again, no response\n\n[29/03/2026] - Tried to reach out to the vendor through Weibo, no response\n\n[30/03/2026] - CVE identifier requested\n\n[31/03/2026] - CVE identifier assigned\n\n[01/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-29014 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-06\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-09T13:49:04Z",
            "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
            "shortName": "VULNARCHIVE"
          },
          "references": [
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://seclists.org/fulldisclosure/2026/Apr/1"
            },
            {
              "url": "https://karmainsecurity.com/KIS-2026-06"
            },
            {
              "url": "https://karmainsecurity.com/pocs/CVE-2026-29014.php"
            },
            {
              "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
            },
            {
              "url": "https://seclists.org/fulldisclosure/"
            },
            {
              "url": "https://www.metinfo.cn"
            }
          ],
          "source": {
            "defect": [
              "https://seclists.org/fulldisclosure/2026/Apr/1"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "[KIS-2026-06] MetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability",
          "x_gcve": [
            {
              "recordType": "reference",
              "relationships": [
                {
                  "destId": "CVE-2026-29014",
                  "type": "related"
                }
              ],
              "vulnId": "GCVE-1988-2026-0274",
              "x_vulnarchive": {
                "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1",
                "automated": true,
                "contentSha256": "060cffe051aa712afbc32aa96184935f3daa78c6cba712cdcfd82405fa2e66e3",
                "evidenceScore": 7,
                "messageId": "",
                "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/1",
                "policy": "vulnarchive-1",
                "sourceFormat": "text/html",
                "sourcePublishedAt": "2026-04-01T11:54:41Z"
              }
            },
            {
              "recordType": "advisory",
              "vulnId": "gcve-1988-2026-0274"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "assignerShortName": "VULNARCHIVE",
        "datePublished": "2026-09-08T08:13:43Z",
        "dateUpdated": "2026-09-09T13:49:04Z",
        "state": "PUBLISHED",
        "vulnId": "GCVE-1988-2026-0274"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-29014 (GCVE-0-2026-29014)

    Vulnerability from nvd – Published: 2026-04-01 12:22 – Updated: 2026-07-14 18:39
    VLAI
    Title
    MetInfo CMS Unauthenticated PHP Code Injection RCE
    Summary
    MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-04-03 13:46 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Impacted products
    Vendor Product Version
    MetInfo CMS MetInfo CMS Affected: 7.9.0 , ≤ 8.1.0 (semver)
        cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-04-03T16:43:15.767Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://seclists.org/fulldisclosure/2026/Apr/1"
              },
              {
                "url": "https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a"
              }
            ],
            "title": "CVE Program Container",
            "x_generator": {
              "engine": "ADPogram 0.0.1"
            }
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-29014",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-03T13:46:09.243297Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-03T13:56:05.488Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "MetInfo CMS",
              "vendor": "MetInfo CMS",
              "versions": [
                {
                  "lessThanOrEqual": "8.1.0",
                  "status": "affected",
                  "version": "7.9.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.1.0",
                      "versionStartIncluding": "7.9.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Egidio Romano"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.\u003cbr\u003e\u003cbr\u003e"
                }
              ],
              "value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T18:39:51.919Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "tags": [
                "technical-description",
                "exploit"
              ],
              "url": "https://karmainsecurity.com/KIS-2026-06"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://www.metinfo.cn/"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "MetInfo CMS Unauthenticated PHP Code Injection RCE",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-29014",
        "datePublished": "2026-04-01T12:22:42.420Z",
        "dateReserved": "2026-03-03T16:42:01.013Z",
        "dateUpdated": "2026-07-14T18:39:51.919Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-29014 (GCVE-0-2026-29014)

    Vulnerability from cvelistv5 – Published: 2026-04-01 12:22 – Updated: 2026-07-14 18:39
    VLAI
    Title
    MetInfo CMS Unauthenticated PHP Code Injection RCE
    Summary
    MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-04-03 13:46 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Impacted products
    Vendor Product Version
    MetInfo CMS MetInfo CMS Affected: 7.9.0 , ≤ 8.1.0 (semver)
        cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-04-03T16:43:15.767Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://seclists.org/fulldisclosure/2026/Apr/1"
              },
              {
                "url": "https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a"
              }
            ],
            "title": "CVE Program Container",
            "x_generator": {
              "engine": "ADPogram 0.0.1"
            }
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-29014",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-03T13:46:09.243297Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-03T13:56:05.488Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "MetInfo CMS",
              "vendor": "MetInfo CMS",
              "versions": [
                {
                  "lessThanOrEqual": "8.1.0",
                  "status": "affected",
                  "version": "7.9.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "8.1.0",
                      "versionStartIncluding": "7.9.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Egidio Romano"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.\u003cbr\u003e\u003cbr\u003e"
                }
              ],
              "value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T18:39:51.919Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "tags": [
                "technical-description",
                "exploit"
              ],
              "url": "https://karmainsecurity.com/KIS-2026-06"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://www.metinfo.cn/"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "MetInfo CMS Unauthenticated PHP Code Injection RCE",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-29014",
        "datePublished": "2026-04-01T12:22:42.420Z",
        "dateReserved": "2026-03-03T16:42:01.013Z",
        "dateUpdated": "2026-07-14T18:39:51.919Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }