Skip to content
OpenAdvisories

Package · Packagist

mantisbt/mantisbt

74 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.1
    CVE-2018-14504

    MantisBT allows XSS on the Edit Filter page via crafted filter name

    An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted na…

    mantisbt/mantisbt Packagist
  • Medium 6.1
    CVE-2017-12062

    MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php

    An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

    mantisbt/mantisbt Packagist
  • Medium 6.1
    CVE-2017-12061

    MantisBT XSS allows unsanitized input via admin/install.php

    An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrar…

    mantisbt/mantisbt Packagist
  • Medium 6.5
    CVE-2017-7620 Public exploit

    MantisBT vulnerable to CSRF and Open Redirect attacks

    MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

    mantisbt/mantisbt Packagist
  • Medium 6.1
    CVE-2017-7897

    MantisBT XSS via my_view_page.php and view_user_page.php

    A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit…

    mantisbt/mantisbt Packagist
  • Medium 4.8
    CVE-2017-7309 EPSS 63%

    MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php

    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.…

    mantisbt/mantisbt Packagist
  • Medium 4.8
    CVE-2017-7241

    MantisBT XSS via move_attachments_page.php

    A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) setting…

    mantisbt/mantisbt Packagist
  • Medium 4.8
    CVE-2017-6973

    MantisBT XSS via adm_config_report.php's action parameter

    A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

    mantisbt/mantisbt Packagist
  • Medium 4.7
    CVE-2016-7111

    MantisBT XSS through weak CSP when using Gravatar plugin

    MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

    mantisbt/mantisbt Packagist