MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability. Remote attackers can execute arbitrary code by sending crafted requests with malicious PHP code. The vulnerability stems from insufficient input neutralization in the execution path. Successful exploitation allows attackers to achieve remote code execution and gain full control over the affected server. This is a critical vulnerability affecting multiple versions of the popular MetInfo CMS platform.