-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | < 1.3.3 | 1.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two primary locations: 1) The user_ip() function in helpers.php directly used X-Forwarded-For header values without proper IP format validation, allowing arbitrary input storage. 2) The site statistics tracker in Tracker.php processed and stored user-controlled headers without sanitization (added in patch via strip_tags and e() calls). The commit diff clearly shows these functions received security fixes: IP validation regex in user_ip() and HTML encoding in Tracker.php, confirming these were the vulnerable points where untrusted input was accepted without proper neutralization.
Ongoing coverage of React2Shell