GHSA-rqgj-rqfr-5j6fMediumCVSS 6.1

MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php

Published
April 14, 2022
Last Modified
June 9, 2025

🔗 CVE IDs covered (1)

CVE-2022-26144 →

📋 Description

An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.

🎯 Affected products1

  • composer/mantisbt/mantisbt:<= 2.25.2

🔗 References (4)