-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| idno/known | composer | <= 1.3.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The Homepage::postContent function processes user input for profile fields without sanitization before storage. 2) The User::getTitle method retrieves raw user-controlled data that is later insecurely rendered. The blog analysis shows htmlspecialchars was applied to configuration values derived from user input rather than validating/sanitizing the input directly. This creates a scenario where malicious payloads persist in storage and execute during rendering, particularly in admin-controlled contexts that affect site-wide display. The combination of missing input validation and improper output encoding in these specific functions matches the described XSS attack vector through the 'Your Name' field.
Ongoing coverage of React2Shell