XSS in Mantisbt

CVE-2013-4460

Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.015 (71.5th percentile) — read the EPSS interpretation.

Affected products

  • Mantisbt — versions 1.0.0, 1.0.1, 1.0.2
  • N/a — versions n/a

Weakness classification (CWE)

References