CVE-2026-41897mediumCWE-79

CVE-2026-41897: falha de média gravidade em mantisbt

MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mantisbt+ Monitorar mantisbt/mantisbt

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This vulnerability is fixed in 2.28.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
mantisbt · mantisbt
CVEs relacionadas — mantisbt

No mesmo produto, das mais perigosas para as menos.

CVE-2026-30849CRITICALMantisBT SOAP API has an authentication bypass vulnerability on MySQLEPSS 1.8%CVE-2024-34077HIGHMantisBT user account takeover in the signup/reset password processEPSS 1.2%CVE-2024-23830HIGHMantisBT Host Header Injection vulnerabilityEPSS 1.0%CVE-2023-44394MEDIUMDisclosure of project names to unauthorized users in MantisBTEPSS 0.7%CVE-2024-34080MEDIUMMantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized ActorEPSS 0.7%CVE-2026-47156CRITICALMantisBT: SOAP API Authentication Bypass with Privilege Escalation to AdministratorEPSS 0.7%