-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mautic/core | composer | < 3.2.4 | 3.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input handling in Social Monitoring's title/name fields. The Controller action that processes form submissions (saveAction) and the Entity setter method (setTitle) that persists the data are critical points where input sanitization should occur. The Bishop Fox PoC demonstrates XSS execution via the monitoring[title] parameter, indicating these functions failed to validate()/escape user-controlled input before storage. The stored payloads then render unsafely in dashboard widgets and contact views, enabling privilege escalation attacks.