-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 3.0.0, <= 3.8.3 | 3.8.4 |
| craftcms/cms | composer | >= 4.0.0, <= 4.4.3 | 4.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from JSON encoding that did not escape forward slashes (due to JSON_UNESCAPED_UNICODE). This allowed attackers to craft titles with </script> payloads, breaking out of JavaScript contexts. The commit removed JSON_UNESCAPED_UNICODE from all Json::encode calls, ensuring proper escaping. The affected functions directly handled user-controlled data (e.g., RSS feed titles) and passed it to Json::encode with unsafe flags, making them the root cause.
KEV Misses 88% of Exploited CVEs- Get the report