-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.0.0, < 4.0.10.1 | 4.0.10.1 |
| phpmyadmin/phpmyadmin | composer | >= 4.1.0, < 4.1.14.2 | 4.1.14.2 |
| phpmyadmin/phpmyadmin | composer | >= 4.2.0, < 4.2.6 | 4.2.6 |
Miggo AIRoot Cause AnalysisThe commit diff shows escaping was added to three locations: (1) DROP TABLE confirmation in functions.js, (2) TRUNCATE TABLE confirmation in functions.js, and (3) column name handling in tbl_structure.js. These locations previously concatenated raw user-controlled input (table/column names) into HTML contexts without escaping, directly enabling XSS. The explicit addition of escapeHtml() in the patch confirms these were the vulnerable points.
A Semantic Attack on Google Gemini - Read the Latest Research