by Kastro
Paper/Archive/CVE-2026-29014

CVE-2026-29014

MetInfo CMS MetInfo CMS — MetInfo CMS Unauthenticated PHP Code Injection RCE

EPSS 39%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

Affected

ProductAffectedFixed inSource
MetInfo CMS7.9.0 – 8.1.0–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitkarmainsecurity.com/KIS-2026-06refmetinfo.cnwriteupvulncheck.com/advisories/metinfo-cms-unauthenticated-php-code-injection-rcerefseclists.org/fulldisclosure/2026/Apr/1refwebsec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a