-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerability stemmed from unescaped $_GET['template'] input in mw_set_default_template(). The patch added 'e()' for HTML escaping, proving the original code lacked proper output encoding. While xss_clean() was present, it likely operated in a different context (e.g., input sanitization rather than output encoding), leaving the XSS vector in the template selection flow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | < 1.3.3 | 1.3.3 |
Ongoing coverage of React2Shell