Vulnerabilities

TI-2021-18402 CVE-2021-41750 · GHSA-6hjc-m38h-7jhh

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3…

LOW 29

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url paramete…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01126 Published 2022-06-12 Fixed in 3.4.11 CWE-79

TI-2021-18401 CVE-2021-41749 · GHSA-g7xr-v82w-qggq

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated…

MEDIUM 59

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16787 Published 2022-06-12 Fixed in 3.4.11 CWE-94

TI-2021-20172 CVE-2021-44618 · GHSA-m3xv-x3ph-mq22

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic…

MEDIUM 45

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01395 Published 2022-03-11 Fixed in 3.4.12 CWE-94

TI-2020-10174 CVE-2020-12790 · GHSA-23q7-59jj-2pj4

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not…

LOW 37

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02189 Published 2020-05-11 Fixed in 3.2.49 CWE-74

TI-2018-10569 CVE-2018-14716 · GHSA-6j9m-rp7m-3gfg

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before…

MEDIUM 57

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.32673 Published 2018-08-06 Fixed in 3.1.4 CWE-94