CVE-2022-28508

An XSS issue was discovered in browsersearchplugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

CVE-2022-28508

MantisBT prior to 2.25.2 has a cross-site scripting (XSS) vulnerability in browser_search_plugin.php where the return parameter is not properly sanitized. An attacker can inject arbitrary JavaScript/HTML via a crafted URL, potentially leading to session hijacking or credential theft in the victim...

CVE-2022-28508: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in browsersearchplugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...