Design/Logic Flaw

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...

CVE-2021-44618

SSTI in Nystudio107 Seomatic 3.4.12 (src/helpers/UrlHelper.php via Host header). CVSSv3.1: 9.8 (CRITICAL), network attack, no user interaction. Impact: confidentiality, integrity, availability HIGH. Exploitation details and fix version are not provided in connected documents; remediation steps no...

CVE-2021-44618

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...

CVE-2021-44618: Improper Control of Generation of Code

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...

Nystudio107 Seomatic 代码注入漏洞

Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.12, which stems from a lack of filtering and escaping of...

Seomatic Injection Vulnerability

Pixel & Tonic Craft CMS is a content management system CMS from Pixel & Tonic Inc. in the U.S. Seomatic is one of the SEO search engine optimization components. A security vulnerability exists in Seomatic versions prior to 3.2.49 for Craft CMS, which stems from a failure to properly clean up URLs...

CVE-2020-12790

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

CVE-2020-12790

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

Design/Logic Flaw

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

CVE-2020-12790

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

CVE-2020-12790

The CVE-2020-12790 entry concerns the SEOmatic plugin for Craft CMS before version 3.2.49. The root cause is improper sanitization in helpers/DynamicMeta.php for URL handling, which can allow Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon. ...

CVE-2020-12790: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon...

Server-Side Template Injection (SSTI)

nystudio107/craft-seomatic is vulnerable to server-side template injection. Lack of validation and sanitization allows an attacker to inject and execute arbitrary template variables that can lead to code execution via malicious data to the metacontainers controller...

CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757

Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...

CVE-2020-9757

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...

Server Side Template Injection (SSTI)

nystudio107/seomatic is vulnerable to server side template injection SSTI. The vulnerability is possible through sending requests that don't match any elements, leading to the generation of incorrect canonicalUrl , and execution of Twig code...