-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) Insufficient input sanitization when storing company names (handled by CompanyController's save action), evidenced by Bishop Fox's PoC showing raw HTML in companyname parameter. 2) Lack of output encoding in templates displaying company names, as shown by XSS triggering in multiple contexts (dashboard, contact views). The combination allows stored payloads to persist and execute. While exact file paths are inferred from standard Mautic structure, the attack pattern and CVE description strongly implicate these core handling mechanisms.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mautic/core | composer | >= 3.2.0, < 3.2.4 | 3.2.4 |
| mautic/core | composer | >= 2.0.0, < 2.16.5 | 2.16.5 |
Ongoing coverage of React2Shell