-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs in admin.php, where the 'group' parameter is taken directly from the user-controlled $_GET input (line 15) and printed unsanitized into the module tag's type attribute (line 100). The lack of output encoding (e.g., using htmlspecialchars()) or input validation allows malicious payloads to execute in the victim's browser. The GitHub issue's PoC demonstrates this by injecting a script tag via the 'group' parameter, confirming the exploitability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | <= 2.0.16 |
PHPPHP