-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rainlab/user-plugin | composer | <= 1.4.5 | 1.5.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output in the name field input. The patch replaced form_value('name') with user.name, which implies form_value() lacked built-in escaping. The commit message explicitly states 'form_value() doesn't use escaping', confirming it was the vulnerable function. The XSS occurs when user-supplied input from the name field is rendered without proper sanitization in the template.
Ongoing coverage of React2Shell