-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from multiple functions handling user-controlled data without adequate sanitization before HTML output. The patch adds SecurityHelper::sanitizeHtmlAttributes() to these methods and removes dangerous 'on*' attributes from the allow list. The frontend() method was particularly critical as it directly constructed HTML attributes from unsanitized inputs. The getter methods (getParameters, getAnchor, etc.) returned raw data that flowed into HTML contexts. The setDataFromResource method's lack of sanitization allowed stored XSS payloads. The high confidence comes from the explicit security fixes applied to these specific functions in the commit.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 10.5.21 | 10.5.21 |
Ongoing coverage of React2Shell