9.8 CriticalCWE-94
CVE-2026-29014
MetInfo CMS Unauthenticated PHP Code Injection RCE
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
39%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 5 May · 10:01 UTC | SecurityWeek | MetInfo, Weaver E-cology Vulnerabilities in Attackers’ Crosshairs |
| Tue 5 May · 12:58 UTC | The Hacker News | Attackers exploit CVE-2026-29014 to hijack MetInfo CMS |
- Attackers exploit CVE-2026-29014 to hijack MetInfo CMSThe Hacker News
- MetInfo, Weaver E-cology Vulnerabilities in Attackers’ CrosshairsSecurityWeek · first in our coverage