-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of input sanitization in the assignment of $_POST['mail'] to $mail in pw_forgot.php. The patch introduces FILTER_VALIDATE_EMAIL to validate the email format, which was absent in the original code. The unvalidated $mail variable is then likely echoed in the HTML template without escaping (e.g., via htmlspecialchars()), allowing XSS payloads to execute. While the exact output line isn't shown in the diff, the combination of unfiltered assignment and XSS context confirms this entry point as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| movingbytes/social-network | composer | <= 1.2.1 |
A Semantic Attack on Google Gemini - Read the Latest Research