-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability involves stored XSS via the page title field during page creation. The exploit demonstrates that user-supplied input in the title field (e.g., <script> payloads) is rendered unsanitized. The Page::create controller method is the logical entry point for processing page creation requests in Kirby's admin panel. While the exact code isn't available, the exploit's mechanics and Kirby's architecture strongly suggest this function fails to sanitize the title input before storage or output. Confidence is medium due to reliance on indirect evidence (exploit PoC, CMS structure) without direct code access.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getkirby/cms | composer | <= 2.5.12 |
Ongoing coverage of React2Shell