MetInfo CMS <= 8.1 - Remote Code Execution
CVE-2026-29014
Verified
Description
MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.
Severity
Critical
CVSS Score
9.8
Exploit Probability
4%
Published Date
April 6, 2026
Template Author
0x_akoko
CVE-2026-29014.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-29014
CWE ID:
cwe-94
Remediation Steps
Update to the latest version beyond 8.1.