-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated handling of user-controlled parameters in AjaxAlertController.php. The GitHub patch shows the addition of CHtml::encode() for the 'text' parameter and sanitize_alphanumeric() for 'alertType' and 'tag' parameters. These changes explicitly address missing input validation and output encoding in the translateOptionsForWidget method, which processes the Alert Widget's message component. The pre-patch code lacked these protections, making it the root cause of the XSS vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| limesurvey/limesurvey | composer | < 6.5.0 | 6.5.0 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report