-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| superbig/craft-audit | composer | < 3.0.2 | 3.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user input in title handling during element saving. The pre-patch code shows direct assignment of $title to model->title and snapshot['title'] without encoding. The fix adds Html::encode() to both assignments, confirming these were the vulnerable points. As this matches the CWE-79 pattern of improper input neutralization during web page generation, and the commit explicitly addresses XSS in titles, we can conclusively identify these assignments in onSaveElement as vulnerable.
Ongoing coverage of React2Shell