nystudio107 records
5 published records for vendor nystudio107.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-94 Improper Control of Generation of Code ('Code Injection')3
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
44Plan | CVE-2021-41749Proof of concept | In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injectionystudio107 · seomatic · CWE-94 | Critical9.8 | — | 16.7% | Jun 12, 2022 |
40Plan | CVE-2018-14716Proof of concept | A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match nystudio107 · seomatic · CWE-94 | High7.5 | — | 32.6% | Aug 6, 2018 |
39Monitor | CVE-2021-44618No exploit | A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host headernystudio107 · seomatic · CWE-94 | Critical9.8 | — | 1.3% | Mar 11, 2022 |
31Monitor | CVE-2020-12790No exploit | In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.nystudio107 · seomatic · CWE-74 | High7.5 | — | 2.1% | May 11, 2020 |
24Monitor | CVE-2021-41750No exploit | A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web scrnystudio107 · seomatic · CWE-79 | Medium6.1 | — | 1.1% | Jun 12, 2022 |
- CVE-2021-4174944Plan
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injectio
CriticalCVSS 9.8Proof of conceptEPSS 16%nystudio107 · seomaticJun 12, 2022
- CVE-2018-1471640Plan
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match
HighCVSS 7.5Proof of conceptEPSS 32%nystudio107 · seomaticAug 6, 2018
- CVE-2021-4461839Monitor
A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header
CriticalCVSS 9.8No exploitEPSS 1%nystudio107 · seomaticMar 11, 2022
- CVE-2020-1279031Monitor
In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.
HighCVSS 7.5No exploitEPSS 2%nystudio107 · seomaticMay 11, 2020
- CVE-2021-4175024Monitor
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web scr
MediumCVSS 6.1No exploitEPSS 1%nystudio107 · seomaticJun 12, 2022