-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| limesurvey/limesurvey | composer | < 6.5.12 | 6.5.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped insertion of user-controlled input (title/comment fields) into HTML contexts. The commit diff shows the addition of htmlentities() sanitization to these fields in both the main.js build file and source modal dialog file. The vulnerable functions handle the rendering of user-supplied content in file upload interfaces, which would execute arbitrary scripts if malicious input was stored and rendered. The patch directly addresses these insertion points, confirming their vulnerability.