CVE-2024-34081: Improper Neutralization of Input During Web Page Generation

MantisBT Mantis Bug Tracker is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues bugchangestatuspage.php belonging to a project linking...

CVE-2020-16266: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue if CSP...

CVE-2018-6526: Exposure of Sensitive Information to an Unauthorized Actor

viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...

FreeBSD : mantis -- XSS vulnerability (2b63e964-eb04-11e6-9ac1-a4badb2f4699)

wdollman reports : The value of the viewtype parameter on the viewallbugpage.php page is not encoded before being displayed on the page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

mantis -- XSS vulnerability

wdollman reports: The value of the viewtype parameter on the viewallbugpage.php page is not encoded before being displayed on the page...

CVE-2014-9089

Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter to viewallset.php...

CVE-2014-9089: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 1 sort or 2 dir parameter to viewallset.php...

CVE-2005-3090: Undefined Security Weakness

Cross-site scripting XSS vulnerability in bugactiongrouppage.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the summary of the bug, which is not quoted when viewallbugpage.php is used to delete the bug, as identified by bug0006002, a...

CVE-2002-1116: Undefined Security Weakness

The "View Bugs" page viewallbugpage.php in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects...