CVE-2018-19836 — In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value

Back Back to CVE browser

MEDIUM

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value

Published Dec 3, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.80%

Description

In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.80% 0.00798

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00798

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.80% (0.00798)	54.97th	v5 (v2026.06.15)
Sep 20, 2026	0.80% (0.00798)	54.98th	v5 (v2026.06.15)
Jul 20, 2024	0.07% (0.00071)	31.40th	v3 (v2023.03.01)
Jun 15, 2024	0.07% (0.00071)	30.98th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00071)	28.98th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.42% (0.00416)	10.04th	v5 (v2026.06.15)
Apr 14, 2021	0.42% (0.00416)	0.00th	v1