-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 24.4.0 | 24.4.0 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from inline SQL query construction in packages.inc.php where user-controlled $_POST['package'] was directly interpolated into a SQL query string (line 83 in original code). The patch replaced this with parameterized queries (? placeholder) and added proper input handling. While no named function is explicitly mentioned, the SQL query construction logic in this file is the vulnerable component. The confidence is high as the commit diff clearly shows unsafe string interpolation being replaced with proper parameter binding.
Ongoing coverage of React2Shell