MantisBT Cross-site Scripting vulnerability

LOW 2.1CVE-2010-2574 · GHSA-74x7-mfvg-h2wf · Published 10/08/2010 · updated 16/06/2026

In short

CVE-2010-2574 is a LOW (CVSS 2.1) vulnerability affecting mantisbt/mantisbt, mantisbt (mantisbt).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`≤ 1.2.2`	No fix yet
mantisbt mantisbt	`= 1.2.2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.

NVD description

References

More vulnerabilities in mantisbt/mantisbt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free