-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mayan-edms | pip | >= 0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from: 1) The 'safe' filter in calculate_form_title.html disabling Django's auto-escaping when 'striptags' wasn't applied to user-controlled titles. 2) Incomplete sanitization via 'striptags' in list templates, which doesn't prevent all XSS vectors. The commit 398c480 removed both problematic filters, enforcing default HTML escaping. The CVE description explicitly cites these template handling patterns as injection points for tags/titles/web form fields.
Ongoing coverage of React2Shell