-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.6.0, < 4.6.6 | 4.6.6 |
| phpmyadmin/phpmyadmin | composer | >= 4.4.0, < 4.4.15.10 | 4.4.15.10 |
| phpmyadmin/phpmyadmin | composer | >= 4.0.0, < 4.0.10.19 | 4.0.10.19 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of cookie parameters used in theme selection. The advisory explicitly references theme-related commits (3a62476, bd3677f, 8a08162) across branches, which focus on input validation for theme names. These functions are central to cookie-based theme selection and CSS resource loading. The CWE-79 classification confirms the XSS-like pattern of injecting untrusted input into web page generation (in this case, CSS context). The high confidence comes from the direct correlation between the vulnerability description (CSS injection via cookies), the patched commits targeting theme handling, and the standard phpMyAdmin architecture where ThemeManager handles these operations.
PHPPHPOngoing coverage of React2Shell