Threats tagged 'ghsa-2pmp-x7wc-gxr9'

A Server-Side Request Forgery (SSRF) vulnerability exists in MetInfo CMS versions through 8.1, caused by an XML External Entity (XXE) injection flaw in the XML parsing logic. This allows attackers to craft malicious XML entities that trigger the server to make HTTP requests to arbitrary internal or external addresses. The vulnerability may be exploitable via the backend API associated with the path /admin/#/webset/?head_tab_active=0. Exploitation can lead to internal network reconnaissance, port scanning, or unauthorized access to sensitive information.