VULNERABILITY INTELLIGENCE

CVE-2026-29014

CVSS score9.8 CRITICAL

EPSS probability39.49%

CISA KEVNot currently listed

Published2026-04-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Weakness classification

disclosure@vulncheck.com: CWE-94

Primary references

disclosure@vulncheck.com — Exploit, Third Party Advisory
disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory