CVE-2019-16996

HIGH EXPLOITED NUCLEI

Metinfo 7.0.0beta - SQL Injection via Product Admin ID Parameter

Title source: llm

Exploitation Summary

CVE-2019-16996 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.

Nuclei Templates (1)

Metinfo 7.0.0 beta - SQL Injection

HIGHby ritikchaddha

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/XiaOkuoAi/XiaOkuoAi.github.io/issues/1

Scores

CVSS v3 7.2

EPSS 0.1244

EPSS Percentile 95.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2025-06-08

CWE

CWE-89

Status published

Products (1)

metinfo/metinfo 7.0.0 beta

Published Sep 30, 2019

Tracked Since Feb 18, 2026