-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped rendering of the attacker-controlled product name in the add note dialog. The controller action retrieves the product data, and the associated Twig template renders it. XSS occurs because either: (1) the controller passes raw product name data to the view, or (2) the template fails to apply proper escaping filters when outputting the product name. This matches the classic XSS pattern where user-controlled input (product name) is reflected in HTML without sanitization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oro/commerce | composer | >= 4.1.0, <= 4.1.13 | |
| oro/commerce | composer | >= 4.2.0, <= 4.2.10 | |
| oro/commerce | composer | >= 5.0.0, < 5.0.11 | 5.0.11 |
| oro/commerce | composer | >= 5.1.0, < 5.1.1 | 5.1.1 |
PHPPHPOngoing coverage of React2Shell