← Back to Vulnerability Reports CVE Intelligence

CVE-2026-29014

Metinfo•CRITICAL · CVSS 9.8•No exploitation reported

What is CVE-2026-29014?

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server.

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS4% · P91

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-94

NVD published2026-04-01

NVD last modified2026-06-17

Timeline

2026-04-01Published to the U.S. National Vulnerability Database (NVD)
2026-05-06First covered in a defend.network daily briefing
2026-06-17NVD record last updated

Affected product

Metinfo

References

Referenced in our briefings & reports

Apache HTTP/2 & MetInfo exploited; DAEMON Tools supply-chain hit (2026-05-06)

Related vulnerabilities

CVE-2026-0322 – Palo Alto Networks PAN-OS (same weakness: CWE-94)
CVE-2026-18885 (same weakness: CWE-94)
CVE-2026-6876 (same weakness: CWE-94)
CVE-2026-60004 – Gitea (same weakness: CWE-94)
CVE-2026-72530 – TrueConf Server (same weakness: CWE-94)
CVE-2026-19478 – Gitlab (same weakness: CWE-94)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.