Skip to content
OpenAdvisories

Package · Packagist

mantisbt/mantisbt

74 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2022-28508 Public exploit Scanner template

    MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php

    An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

    mantisbt/mantisbt Packagist
  • Medium 5.3
    CVE-2020-28413 Public exploit

    MantisBT SQL Injection via mc_project_get_users function

    In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.

    mantisbt/mantisbt Packagist
  • Medium 6.5
    CVE-2017-7620 Public exploit

    MantisBT vulnerable to CSRF and Open Redirect attacks

    MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

    mantisbt/mantisbt Packagist