GCVE - cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*

part: a version: 1.2.16 update: *

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.632425
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.632427

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7241`	vulnerable	2026-06-08 05:09:55.543047	Details available A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page. Published: 2017-03-31T04:26:00.000Z Updated: 2024-08-05T15:56:36.253Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2017/03/30/4 http://www.securitytracker.com/id/1038169 http://www.mantisbt.org/bugs/view.php?id=22568 http://www.securityfocus.com/bid/97253	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2046`	vulnerable	2026-06-08 05:06:27.300504	Details available Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. Published: 2017-08-28T15:00:00.000Z Updated: 2024-08-06T05:02:43.218Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1191130 http://www.openwall.com/lists/oss-security/2015/02/21/2 http://www.openwall.com/lists/oss-security/2015/02/21/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1042`	vulnerable	2026-06-08 05:06:24.877444	Details available The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. Published: 2015-02-10T20:00:00.000Z Updated: 2024-08-06T04:33:20.326Z Open on db.gcve.eu Reference links https://www.mantisbt.org/bugs/view.php?id=17997 http://www.securitytracker.com/id/1031633 http://www.openwall.com/lists/oss-security/2015/01/10/5 http://www.openwall.com/lists/oss-security/2015/01/11/8 http://seclists.org/fulldisclosure/2015/Jan/110	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9279`	vulnerable	2026-06-08 05:06:11.312682	Details available The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. Published: 2014-12-08T16:00:00.000Z Updated: 2024-08-06T13:40:25.094Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/71359 https://github.com/mantisbt/mantisbt/commit/0826cef8 http://www.mantisbt.org/bugs/view.php?id=17877 http://seclists.org/oss-sec/2014/q4/863 https://exchange.xforce.ibmcloud.com/vulnerabilities/99031	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9272`	vulnerable	2026-06-08 05:06:11.258622	Details available The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:24.349Z Open on db.gcve.eu Reference links https://github.com/mantisbt/mantisbt/commit/05378e00 https://www.mantisbt.org/bugs/view.php?id=17297 http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9271`	vulnerable	2026-06-08 05:06:11.257376	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9270`	vulnerable	2026-06-08 05:06:11.256108	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9269`	vulnerable	2026-06-08 05:06:11.254620	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8987`	vulnerable	2026-06-08 05:06:10.547381	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8986`	vulnerable	2026-06-08 05:06:10.545474	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8554`	vulnerable	2026-06-08 05:06:09.322040	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6387`	vulnerable	2026-06-08 05:05:57.613617	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2238`	vulnerable	2026-06-08 05:05:28.000294	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.