-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of the 'key name' parameter. The module's data handling functions would receive client-submitted key names and store them, while view templates would display these values. Since the advisory specifically calls out XSS via key name input, the vulnerability must exist in either/both the data ingestion path (insufficient input validation) and output path (lack of output encoding). The high confidence comes from: 1) The vulnerability pattern matches common XSS in MVC frameworks 2) The patch version 1.5 would logically require changes to both data handling and templating 3) The CWE-79 classification confirms this is output sanitization failure
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| munkireport/munki_facts | composer | < 1.5 | 1.5 |
KEV Misses 88% of Exploited CVEs- Get the report