GCVE - cpe:2.3:a:mantisbt:mantisbt:1.2.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:1.2.9:*:*:*:*:*:*:*

part: a version: 1.2.9 update: *

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.632457
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.632459

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-1042`	vulnerable	2026-06-08 05:06:24.873727	Details available The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. Published: 2015-02-10T20:00:00.000Z Updated: 2024-08-06T04:33:20.326Z Open on db.gcve.eu Reference links https://www.mantisbt.org/bugs/view.php?id=17997 http://www.securitytracker.com/id/1031633 http://www.openwall.com/lists/oss-security/2015/01/10/5 http://www.openwall.com/lists/oss-security/2015/01/11/8 http://seclists.org/fulldisclosure/2015/Jan/110	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9272`	vulnerable	2026-06-08 05:06:11.258510	Details available The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:24.349Z Open on db.gcve.eu Reference links https://github.com/mantisbt/mantisbt/commit/05378e00 https://www.mantisbt.org/bugs/view.php?id=17297 http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9271`	vulnerable	2026-06-08 05:06:11.257263	Details available Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:25.100Z Open on db.gcve.eu Reference links http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 https://www.mantisbt.org/bugs/view.php?id=17874 http://seclists.org/oss-sec/2014/q4/902 http://seclists.org/oss-sec/2014/q4/924	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9269`	vulnerable	2026-06-08 05:06:11.254497	Details available Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:24.867Z Open on db.gcve.eu Reference links https://www.mantisbt.org/bugs/view.php?id=17890 https://github.com/mantisbt/mantisbt/commit/511564cc http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8554`	vulnerable	2026-06-08 05:06:09.318458	Details available SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609. Published: 2014-11-13T15:00:00.000Z Updated: 2024-08-06T13:18:48.523Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q4/487 http://www.mantisbt.org/bugs/view.php?id=17812 http://www.securityfocus.com/bid/70856 http://seclists.org/oss-sec/2014/q4/479 https://exchange.xforce.ibmcloud.com/vulnerabilities/98457	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6387`	vulnerable	2026-06-08 05:05:57.609627	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1609`	vulnerable	2026-06-08 05:05:25.696827	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1608`	vulnerable	2026-06-08 05:05:25.693590	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4460`	vulnerable	2026-06-08 05:04:46.938080	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5523`	vulnerable	2026-06-08 05:02:57.034290	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5522`	vulnerable	2026-06-08 05:02:57.032063	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2692`	vulnerable	2026-06-08 05:02:05.556271	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2691`	vulnerable	2026-06-08 05:02:05.551695	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.