CVE-2021-41750

Published: 2022-06-12T12:15Z

Last Modified: 2024-11-21T06:26Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt