-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| feehi/cms | composer | <= 2.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input sanitization during user registration (handled by SiteController::actionSignup) and lack of output encoding when displaying the stored username. While exact code isn't available, Yii framework conventions suggest: 1) The controller action processes raw POST data without adequate filtering, and 2) The User model's validation rules don't sanitize the username field. This matches the attack vector described (stored XSS via username field) and aligns with common XSS patterns in PHP MVC applications.