| Package | Affected versions | Patched versions |
|---|---|---|
| mantisbt/mantisbt | ≥ 2.28.0, < 2.28.1 | 2.28.1 |
| mantisbt | = 2.28.0 |
Improper escaping of Tag name when deleting it in tag_delete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.
Cross-site scripting (XSS).
80990f43153167c73f11eb4b2bc7108d0c3d6b46
%1$s from $s_tag_delete_message string, for example with sed -r -i '/tag_delete_message/s/.%1\$s.//' -- lang/MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free