-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 9.0.0, < 9.5.35 | 9.5.35 |
| typo3/cms-core | composer | >= 10.0.0, < 10.4.29 | 10.4.29 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.11 | 11.5.11 |
| typo3/cms | composer | >= 10.0.0, < 10.4.29 | 10.4.29 |
| typo3/cms | composer | >= 11.0.0, < 11.5.11 | 11.5.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from unescaped user input (receiverName) in the password recovery email template. The commit da61177 shows the fix added f:format.htmlspecialchars() to receiverName in this template, confirming the lack of output encoding was the root cause. The template's translation function arguments were the injection point before patching.
Ongoing coverage of React2Shell