-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.2.7 | 9.2.7 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient output encoding when rendering the group type name. The patch introduced getDisplayName() (which applies the h() escaping function) and replaced direct calls to getName() in these two methods. The original getName() method itself is a simple getter and not inherently vulnerable, but its unescaped usage in getSelectList() and getType() created the XSS vector. The high confidence comes from the direct correlation between the patched locations and the vulnerability description.
Ongoing coverage of React2Shell