CVE-2021-41750

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.

• CWE-79

• https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8Patch, Third Party Advisory
• https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873Patch, Third Party Advisory
• https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/nystudio107/craft-seomatic/commit/4e46b792ce973ac0c652fb330055f41aca1981c8Patch, Third Party Advisory
• https://github.com/nystudio107/craft-seomatic/commit/5f2cdc7c39e0a4bfb60d2f84131508f0a87b2873Patch, Third Party Advisory

Published

Jun 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41745ShowDoc 2.8.3 ihas a file upload vulnerability, where attack…9.8
• CVE-2021-41746SQL Injection vulnerability exists in all versions of Yonyou…7.5
• CVE-2021-41747Cross-Site Scripting (XSS) vulnerability exists in Csdn APP …6.1
• CVE-2021-41748Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41749In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is p…9.8
• CVE-2021-4175livehelperchat is vulnerable to Improper Neutralization of I…5.4
• CVE-2021-41751Buffer overflow vulnerability in file ecma-builtin-array-pro…9.8
• CVE-2021-41752Stack overflow vulnerability in Jerryscript before commit e1…9.8
• CVE-2021-41753A denial-of-service attack in WPA2, and WPA3-SAE authenticat…7.5
• CVE-2021-41754dynamicMarkt <= 3.10 is affected by SQL injection in the par…9.8
• CVE-2021-41755dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-41756dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8