-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| BTCPayServer.Client | nuget | < 1.7.5 | 1.7.5 |
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stems from missing HTML encoding of user-controlled input in multiple controller actions and views. The GitHub commit shows systematic addition of Html.Encode() to variables like app names, email addresses, and API key labels that were previously rendered raw in confirmation dialogs and UI elements. These locations directly injected user input into HTML contexts without proper neutralization, enabling HTML injection attacks. The high confidence comes from the direct correlation between the patched locations and the vulnerability description about improper neutralization of special elements.
Ongoing coverage of React2Shell