-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| yetiforce/yetiforce-crm | composer | <= 6.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Inadequate input sanitization when saving workflow task metadata (TaskAjax.php), and 2) Missing output encoding in multiple workflow configuration templates. The patch adds HTML escaping to template variables and implements proper input validation in the PHP controller, confirming these were the vulnerable points. The XSS occurs through workflow configuration fields that stored unescaped user input and later rendered it unsafely.
Ongoing coverage of React2Shell