-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub patch shows critical changes in admin_organizer.js where title attributes were being built with item.name. The original code used htmlspecialchars(item.name) once, but XSS was still possible due to context-aware escaping requirements. The vulnerability stems from insufficient output encoding when handling user-supplied referer URLs in error logs, which were then reflected in admin-facing title attributes without proper sanitization. The fix applies double escaping (htmlspecialchars(htmlspecialchars(...))) to prevent this injection.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tribalsystems/zenario | composer | < 8.5.51340 | 8.5.51340 |
Ongoing coverage of React2Shell