-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | <= 7.0.13 |
Miggo AIRoot Cause AnalysisThe vulnerability involves stored XSS via XML file uploads leading to privilege escalation. The /users/{id}/#files endpoint suggests user-file handling logic in UsersController. Typical Laravel patterns would use uploadFile for processing uploads and showFile for rendering content. The absence of patched versions and commit diffs necessitates inference: (1) Missing XML input sanitization during uploads allows payload storage, and (2) Unsafe output rendering in file previews triggers execution. Confidence is medium due to reliance on framework conventions and vulnerability mechanics, though exact code isn't visible.
Ongoing coverage of React2Shell