-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bolt/bolt | composer | < 3.6.10 | 3.6.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) Insufficient input sanitization when storing user-controlled alt/title fields in the admin interface (FileManagerController), and 2) Lack of proper HTML attribute escaping during template rendering (TemplateTwigExtension). The patch in 3.6.10 (#7801) specifically targeted these areas by adding HTML escaping for these fields, confirming these as the vulnerable components. The authenticated XSS vector aligns with FileManagerController's role in handling privileged user input.
KEV Misses 88% of Exploited CVEs- Get the report