-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.0.1, <= 3.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from 3 parameters (s_additionalhtml*) being injected into Moodle's output layers. Core output rendering functions handling header/footer content would be responsible for embedding these parameters. While exact function names aren't explicitly listed in advisories, Moodle's architecture uses centralized output components (like those in outputcomponents.php) to handle theme rendering. The lack of output escaping for these admin-configured HTML fields matches the XSS pattern described.
PHPPHPOngoing coverage of React2Shell