CRITICAL CWE-94
CVE-2026-29014
MetInfo CMS Unauthenticated PHP Code Injection RCE
9.8/ 10
CVSS 3.1
Critical severity
39%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list, but a public proof of concept exists.
Timeline
- Published
- Apr 1, 2026
- Updated
- Jul 14, 2026
- First covered
- Jul 11, 2026
- Latest story
- 4 months ago
Summary
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
CWE-94Improper Control of Generation of Code ('Code Injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
- MetInfo CMS7.9.0 to 8.1.0