-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper encoding in URL construction and HTML attribute generation. The patch diff shows critical changes: 1) Replacing urlencode() with rawurlencode() in OEmbed URL construction, 2) Adding htmlspecialchars() encoding in iframe src attributes, 3) Introducing proper attribute escaping via implodeAttributes(). The vulnerable functions directly handled user-controlled video IDs and URL parameters without sufficient encoding, enabling XSS when malicious content was injected into YouTube/Vimeo media identifiers. The high confidence comes from clear pre-patch absence of encoding and post-patch security-focused encoding additions.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 7.0.0, < 7.6.32 | 7.6.32 |
| typo3/cms | composer | >= 8.0.0, < 8.7.21 | 8.7.21 |
| typo3/cms | composer | >= 9.0.0, < 9.5.2 | 9.5.2 |
Ongoing coverage of React2Shell