-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Use of htmlspecialchars instead of htmlentities for fields like title, tags, and author, which doesn't properly encode all special characters in the HTML context. 2) Complete lack of output encoding for notifyUser and notifyEmail hidden inputs in the form. The patch addressed both by switching to htmlentities and adding encoding for the hidden fields. The 'name' field vulnerability specifically maps to the notifyUser parameter based on the form structure and patch changes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 3.1.13 | 3.1.13 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report