-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized use of the 'success' parameter in the /user endpoint. Since the payload executes when the parameter is reflected in the response, the function responsible for rendering this parameter in HTML output (likely in user controller logic) fails to apply proper context-aware escaping (e.g., htmlspecialchars() in PHP). The high confidence comes from the clear parameter reflection pattern matching classic XSS and the documented impact path through admin account takeover.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wwbn/avideo | composer | < 12.4 | 12.4 |