MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending cr…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 1, 2026 · NIST NVD

   Detected

   MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

2. Jun 17, 2026 · NIST NVD

   Updated

   MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Affected

• cpe metinfo/metinfo7.9
• cpe metinfo/metinfo8.0.0
• cpe metinfo/metinfo8.1

Sources

• CVE.orgVulnerability recordCVE-2026-29014

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-29014

  MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution

  nvd.nist.gov

References

• Mailing List · seclists.org
• Exploit · karmainsecurity.com
• Exploit · websec.net
• Product · metinfo.cn
• Third Party Advisory · vulncheck.com