-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xataface/xataface | composer | < 3.0.0 | 3.0.0 |
Miggo AIRoot Cause AnalysisThe commit diff shows both functions were vulnerable due to: 1) Use of eval() with unvalidated server responses (XSS payload vector), 2) innerHTML assignment instead of text-safe innerText. The vulnerability description explicitly mentions testftp, but the identical pattern in testdb was also patched. The XSS occurs because eval() could execute arbitrary JS from server responses, and innerHTML would render HTML/JS content.
Ongoing coverage of React2Shell