CVE-2022-28508

MantisBT prior to 2.25.2 has a cross-site scripting (XSS) vulnerability in browser_search_plugin.php where the return parameter is not properly sanitized. An attacker can inject arbitrary JavaScript/HTML via a crafted URL, potentially leading to session hijacking or credential theft in the victim...