https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-11718.htmlhttps://patchthecve.com/cve/CVE-2017-11718.htmlWed, 17 Jun 2026 01:02:14 +0000MEDIUM 6.1: There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.https://patchthecve.com/cve/CVE-2017-11717.htmlhttps://patchthecve.com/cve/CVE-2017-11717.htmlWed, 17 Jun 2026 01:02:14 +0000HIGH 7.5: MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page.https://patchthecve.com/cve/CVE-2017-11716.htmlhttps://patchthecve.com/cve/CVE-2017-11716.htmlWed, 17 Jun 2026 01:02:14 +0000MEDIUM 6.1: MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.https://patchthecve.com/cve/CVE-2017-11715.htmlhttps://patchthecve.com/cve/CVE-2017-11715.htmlWed, 17 Jun 2026 01:02:14 +0000CRITICAL 9.8: job/uploadfile_save.php in MetInfo through 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.