-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped use of the contentLink parameter in phpmyfaq/api.service.php. The patch explicitly adds Strings::htmlentities() to sanitize this parameter, confirming the lack of output encoding was the root cause. The code context involves FAQ answer construction, where user-controlled input (contentLink) was rendered without proper HTML escaping, enabling stored XSS.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyfaq/phpmyfaq | composer | = 3.2.5 | 3.2.6 |
A Semantic Attack on Google Gemini - Read the Latest Research