-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe core vulnerability stems from the SharedController's save method not sanitizing user input before persistence. While the advisory was withdrawn due to admin-only access, the technical analysis shows: 1) The save method directly writes POST data to AM_FILE_SHARED_DATA without sanitization 2) Multiple template files (post.php, navbar.php etc.) directly output this stored data without escaping 3) The vendor's security.md confirms admins have template modification privileges, making stored XSS relevant even in admin context. The save method is the root cause as it allows persistent storage of raw user input that gets executed during rendering.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| automad/automad | composer | <= 1.10.9 |
KEV Misses 88% of Exploited CVEs- Get the report