-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | < 2.0.3 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation in profile picture handling. The GitHub commit diff shows removal of file upload inputs (wire:model='photo') and WithFileUploads trait from Livewire components, which were likely responsible for processing uploads. The CHANGELOG for v2.0.3 explicitly mentions fixing user image upload issues. Without proper file type checking and output encoding, attackers could upload malicious files (e.g., SVG with embedded JavaScript) or inject XSS payloads via filenames, which would execute when rendered in admin/user profiles.
KEV Misses 88% of Exploited CVEs- Get the report