2207 matches found
CVE-2021-41750
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
CVE-2021-41750
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
Cross site scripting
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
CVE-2021-41750
A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...
CVE-2021-41750
The CVE-2021-41750 entry corresponds to a cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3. The issue arises from a flaw in the handling of a GET request to /index.php?action=seomatic/file/seo-file-link, where the url parameter (base64-encoded URL) and fileNa...
CVE-2021-41749
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution...
CVE-2021-41749
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution...
Remote code execution
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution...
CVE-2021-41749
The CVE-2021-41749 entry affects the SEOmatic plugin for Craft CMS 3 up to version 3.4.11. The Nuclei template documents an unauthenticated Server-Side Template Injection (SSTI) vulnerability that allows an attacker to execute arbitrary Twig templates and system commands via the X-Forwarded-Host ...
CVE-2021-41749
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution...
CVE-2022-32546
A vulnerability was found in ImageMagick. When crafted or untrusted input is processed, it causes issues outside the range of representable values of type 'unsigned long' at coders/pcl.c. This issue leads to a negative impact on application availability or other problems related to undefined...
GHSA-33JJ-92PX-M4G7 Craft CMS Cross-site Scripting Vulnerability
Cross Site Scripting XSS vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new...
Craft CMS Cross-site Scripting Vulnerability
Cross Site Scripting XSS vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new...
GHSA-JHHF-C849-3RH2 Comments plugin stored Cross-site Scripting via a guest name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...
GHSA-4R8C-PJ7X-M5JX Comments plugin Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
GHSA-69WW-WV3J-MHG4 Comments plugin stored Cross-site Scripting (XSS) via an asset volume name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
Comments plugin Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
Comments plugin stored Cross-site Scripting via a guest name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...
Comments plugin stored Cross-site Scripting (XSS) via an asset volume name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...