-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commits 75a5582, aca42ef, and edffb52 explicitly show fixes adding escaping to user-controlled inputs in these components. The vulnerability description lists table names, SET values, search queries, and hostnames as vectors - these correspond to the unescaped $each_table (DbSearch), $uri (header_location), and $type/$value (rows_zoom) variables respectively. The lack of context-aware output encoding (HTML + JS escaping) in these locations directly matches the XSS vulnerability patterns described.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.0, < 4.0.10.13 | 4.0.10.13 |
| phpmyadmin/phpmyadmin | composer | >= 4.4, < 4.4.15.3 | 4.4.15.3 |
| phpmyadmin/phpmyadmin | composer | >= 4.5, < 4.5.4 | 4.5.4 |
PHPPHPOngoing coverage of React2Shell