-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 3.1.12 | 3.1.12 |
Miggo AIRoot Cause AnalysisThe GitHub patch shows the vulnerable code was rendering $newsComment->getUsername() without HTML entity conversion. The fix added Strings::htmlentities() wrapping around this method call. This directly indicates that: 1) getUsername() returns user-controlled input 2) The output was previously not sanitized 3) This unsanitized output was used in an HTML context (mailto link text). The combination of these factors created the XSS vulnerability. No other functions show similar unsanitized output patterns in the provided diff.
PHPPHPOngoing coverage of React2Shell