-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | = 6.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability arises in card.php where the 'id' parameter is fetched using GETPOST('id') and directly embedded into the HTML output without sanitization. The GitHub issue explicitly identifies GETPOST('id') as the root cause due to missing validation. Since Dolibarr's GETPOST function does not enforce sanitization by default (requiring explicit parameters like 'sanitize' or type constraints), this usage in card.php creates an XSS vector when the unsanitized 'id' is reflected in the page.
Ongoing coverage of React2Shell