CVE-2026-52847

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in "/admin/install.php". User-supplied parameters are echoed into HTML without escaping via printtestresult. No authentication is required. A Content Security Policy script-src 'self' prevents inline JavaScript execution, but...