SEOmatic for CraftCMS allows Server-Side Template Injection

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

CVE-2020-12790

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

CVE-2020-12790: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

PT-2020-13270

Name of the Vulnerable Software and Affected Versions SEOmatic plugin versions prior to 3.2.49 for Craft CMS Description The issue arises from improper sanitization of the URL in the helpers/DynamicMeta.php file, leading to Server-Side Template Injection. This can result in credentials disclosure...