-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability report explicitly identifies filterAttr as the affected function. The commit diff shows: 1) Security checks were applied to raw attrSubSet[1] before HTML entity decoding, allowing encoded XSS payloads to bypass detection. 2) The patch moves unhtmlentities() before the data URL check and adds script tag filtering. The original flow made it vulnerable to encoded payloads in attributes, which matches the XSS vulnerability description. While other functions (filterTags) were modified in the commit, only filterAttr is explicitly called out in the CVE description as the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nukeviet/nukeviet | composer | < 4.5 | 4.5 |
Ongoing coverage of React2Shell