-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped inclusion of the redirect parameter in the registration link URL within the login.phtml template. The commit diff explicitly shows the addition of $this->escapeUrl() to sanitize the parameter, confirming that the absence of this escaping mechanism in versions <1.2.2 allowed XSS. The vulnerable code directly outputs user-controlled input ($this->redirect) without sanitization, making the template's URL construction logic the root cause.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zf-commons/zfc-user | composer | < 1.2.2 | 1.2.2 |