-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user input in the findAction method. The patch adds preg_replace filters to remove non-alphanumeric characters from 'type', 'subtype', and 'class' parameters, proving these inputs were previously vulnerable to SQL injection. As these parameters are used to build search queries, unpatched versions would allow attackers to inject malicious SQL payloads, leading to database compromise and potential RCE via subsequent attacks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.5.19 | 10.5.19 |
PHPPHPOngoing coverage of React2Shell