Search
Find a vulnerability
Search criteria
3 vulnerabilities by Metinfo Cms
GCVE-1988-2026-0274
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 13:49
VLAI
EPSS
VEX
Title
[KIS-2026-06] MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability
Summary
---------------------------------------------------------------------------
MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability
---------------------------------------------------------------------------
[-] Software Link:
https://www.metinfo.cn
[-] Affected Versions:
Versions 7.9, 8.0, and 8.1.
[-] Vulnerability Description:
The vulnerable code is located into the
/app/system/weixin/include/class/weixinreply.class.php script.
Specifically, within the weixinreply::wxAdminLogin() method:
149. public function wxAdminLogin($data = array(),$code = '')
150. {
151. global $_M;
152. $weixinapi = load::mod_class('weixin/weixinapi','new');
153. $login_code = cache::get("weixin/".$code);
154. if ($login_code) {
155. cache::put("weixin/".$login_code,$data['FromUserName']);
156. }
157. return;
158. }
User input passed through the "EventKey" and "FromUserName" XML tags
from the HTTP request body when dispatching weixin API requests is not
properly sanitized before being used in a call to the cache::get() and
cache::put() methods respectively.
Specifically, the $code parameter may include Path Traversal
sequences, making the cache::get() method into including arbitrary PHP
files. This can be abused to set the $login_code variable to the
"Array" string by including an arbitrary cache file. Subsequently, the
cache::put() method will write the "FromUserName" parameter into the
/cache/weixin/Array.php file, embedding it within double quotes:
30. public static function put($file, $data, $type = 'php')
31. {
32. global $_M;
33.
34. load::sys_func('file');
35. $save = PATH_CACHE . $file . '.' . $type;
36. makefile($save);
37. #$data = str_replace(array("\"", "\\"), array("\\\"",
"\\\\"), $data);
38. if (!is_array($data)) {
39. file_put_contents($save, "<?php\ndefined('IN_MET') or
exit('No permission');\n\$cache=\"{$data}\";\n?>");
40. } else {
41. $info = var_export($data, true);
42. $info = "<?php\ndefined('IN_MET') or exit('No
permission');\n\$cache = {$info};\n?>";
43. file_put_contents($save, $info);
44. }
45. }
This can be exploited by remote, unauthenticated attackers to inject
and execute arbitrary PHP code by abusing PHP's complex curly syntax,
leading to unauthenticated Remote Code Execution (RCE).
NOTE: when MetInfo is running on non-Windows servers, successful
exploitation of this vulnerability requires the /cache/weixin/
directory to exist, which is created when installing and configuring
the official WeChat plugin.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-29014.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[26/02/2026] - Vendor contacted through several @metinfo.cn and
@mituo.cn email addresses, no response
[07/03/2026] - Tried to reach out to the vendor again, no response
[28/03/2026] - Tried to reach out to the vendor once again, no response
[29/03/2026] - Tried to reach out to the vendor through Weibo, no response
[30/03/2026] - CVE identifier requested
[31/03/2026] - CVE identifier assigned
[01/04/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-29014 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-06
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metinfo Cms | MetInfo CMS |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0274 (this record)
- related CVE-2026-29014
{
"containers": {
"cna": {
"affected": [
{
"product": "MetInfo CMS",
"vendor": "Metinfo Cms",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------------\nMetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.metinfo.cn\n\n\n[-] Affected Versions:\n\nVersions 7.9, 8.0, and 8.1.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located into the\n/app/system/weixin/include/class/weixinreply.class.php script.\n\nSpecifically, within the weixinreply::wxAdminLogin() method:\n\n149. public function wxAdminLogin($data = array(),$code = \u0027\u0027)\n150. {\n151. global $_M;\n152. $weixinapi = load::mod_class(\u0027weixin/weixinapi\u0027,\u0027new\u0027);\n153. $login_code = cache::get(\"weixin/\".$code);\n154. if ($login_code) {\n155. cache::put(\"weixin/\".$login_code,$data[\u0027FromUserName\u0027]);\n156. }\n157. return;\n158. }\n\nUser input passed through the \"EventKey\" and \"FromUserName\" XML tags\nfrom the HTTP request body when dispatching weixin API requests is not\nproperly sanitized before being used in a call to the cache::get() and\ncache::put() methods respectively.\n\nSpecifically, the $code parameter may include Path Traversal\nsequences, making the cache::get() method into including arbitrary PHP\nfiles. This can be abused to set the $login_code variable to the\n\"Array\" string by including an arbitrary cache file. Subsequently, the\ncache::put() method will write the \"FromUserName\" parameter into the\n/cache/weixin/Array.php file, embedding it within double quotes:\n\n30. public static function put($file, $data, $type = \u0027php\u0027)\n31. {\n32. global $_M;\n33.\n34. load::sys_func(\u0027file\u0027);\n35. $save = PATH_CACHE . $file . \u0027.\u0027 . $type;\n36. makefile($save);\n37. #$data = str_replace(array(\"\\\"\", \"\\\\\"), array(\"\\\\\\\"\",\n\"\\\\\\\\\"), $data);\n38. if (!is_array($data)) {\n39. file_put_contents($save, \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or\nexit(\u0027No permission\u0027);\\n\\$cache=\\\"{$data}\\\";\\n?\u003e\");\n40. } else {\n41. $info = var_export($data, true);\n42. $info = \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or exit(\u0027No\npermission\u0027);\\n\\$cache = {$info};\\n?\u003e\";\n43. file_put_contents($save, $info);\n44. }\n45. }\n\nThis can be exploited by remote, unauthenticated attackers to inject\nand execute arbitrary PHP code by abusing PHP\u0027s complex curly syntax,\nleading to unauthenticated Remote Code Execution (RCE).\n\nNOTE: when MetInfo is running on non-Windows servers, successful\nexploitation of this vulnerability requires the /cache/weixin/\ndirectory to exist, which is created when installing and configuring\nthe official WeChat plugin.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-29014.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[26/02/2026] - Vendor contacted through several @metinfo.cn and\n@mituo.cn email addresses, no response\n\n[07/03/2026] - Tried to reach out to the vendor again, no response\n\n[28/03/2026] - Tried to reach out to the vendor once again, no response\n\n[29/03/2026] - Tried to reach out to the vendor through Weibo, no response\n\n[30/03/2026] - CVE identifier requested\n\n[31/03/2026] - CVE identifier assigned\n\n[01/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-29014 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-06\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:49:04Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Apr/1"
},
{
"url": "https://karmainsecurity.com/KIS-2026-06"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-29014.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.metinfo.cn"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Apr/1"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-06] MetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-29014",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0274",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1",
"automated": true,
"contentSha256": "060cffe051aa712afbc32aa96184935f3daa78c6cba712cdcfd82405fa2e66e3",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/1",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-01T11:54:41Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0274"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:43Z",
"dateUpdated": "2026-09-09T13:49:04Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0274"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29014 (GCVE-0-2026-29014)
Vulnerability from nvd – Published: 2026-04-01 12:22 – Updated: 2026-07-14 18:39
VLAI
EPSS
VEX
Title
MetInfo CMS Unauthenticated PHP Code Injection RCE
Summary
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-03 13:46 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-06 | technical-descriptionexploit |
| https://www.metinfo.cn/ | product |
| https://www.vulncheck.com/advisories/metinfo-cms-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Apr/1 | |
| https://websec.net/blog/cve-2026-29014-metinfo-cm… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MetInfo CMS | MetInfo CMS |
Affected:
7.9.0 , ≤ 8.1.0
(semver)
cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-04-03T16:43:15.767Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Apr/1"
},
{
"url": "https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29014",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-03T13:46:09.243297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T13:56:05.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "MetInfo CMS",
"vendor": "MetInfo CMS",
"versions": [
{
"lessThanOrEqual": "8.1.0",
"status": "affected",
"version": "7.9.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.1.0",
"versionStartIncluding": "7.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T18:39:51.919Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-06"
},
{
"tags": [
"product"
],
"url": "https://www.metinfo.cn/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MetInfo CMS Unauthenticated PHP Code Injection RCE",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-29014",
"datePublished": "2026-04-01T12:22:42.420Z",
"dateReserved": "2026-03-03T16:42:01.013Z",
"dateUpdated": "2026-07-14T18:39:51.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29014 (GCVE-0-2026-29014)
Vulnerability from cvelistv5 – Published: 2026-04-01 12:22 – Updated: 2026-07-14 18:39
VLAI
EPSS
VEX
Title
MetInfo CMS Unauthenticated PHP Code Injection RCE
Summary
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-03 13:46 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-06 | technical-descriptionexploit |
| https://www.metinfo.cn/ | product |
| https://www.vulncheck.com/advisories/metinfo-cms-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Apr/1 | |
| https://websec.net/blog/cve-2026-29014-metinfo-cm… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MetInfo CMS | MetInfo CMS |
Affected:
7.9.0 , ≤ 8.1.0
(semver)
cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-04-03T16:43:15.767Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Apr/1"
},
{
"url": "https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29014",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-03T13:46:09.243297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T13:56:05.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "MetInfo CMS",
"vendor": "MetInfo CMS",
"versions": [
{
"lessThanOrEqual": "8.1.0",
"status": "affected",
"version": "7.9.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metinfo:metinfo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.1.0",
"versionStartIncluding": "7.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T18:39:51.919Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-06"
},
{
"tags": [
"product"
],
"url": "https://www.metinfo.cn/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rce"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MetInfo CMS Unauthenticated PHP Code Injection RCE",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-29014",
"datePublished": "2026-04-01T12:22:42.420Z",
"dateReserved": "2026-03-03T16:42:01.013Z",
"dateUpdated": "2026-07-14T18:39:51.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}