-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| admidio/admidio | composer | < 4.3.12 | 4.3.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input sanitization in the message handling code. The commit diff shows the fix changed validation from 'html' to 'string' type for private messages in admFuncVariableIsValid. The 'html' type validation likely permitted raw HTML storage without adequate escaping, enabling XSS (CWE-79). The PoC demonstrates HTML injection via <h1> tags being rendered, confirming insufficient output encoding. The direct correlation between the vulnerable pattern in the diff and the described HTML injection impact supports high confidence in this being the vulnerable function.
Ongoing coverage of React2Shell