deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g434-3q2j-hj4r
Package: codeigniter/framework (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-384: Session Fixation
Vulnerable versions: < 3.1.10
Patched in: 3.1.10

Summary: CodeIgniter Session Fixation Vulnerability

Details:
A Session Fixation issue exists in CodeIgniter before 3.1.10 because `session.use_strict_mode` in the Session Library was mishandled.
GitHub Security Advisory: GHSA-x3c7-22c8-prg7
Package: handcraftedinthealps/goodby-csv (COMPOSER)
Severity: LOW (CVSS 3.9)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 1.4.3
Patched in: 1.4.3

Summary: handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution

Details:
### Impact

goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

### Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with Version 1.4.3

### Workarounds

Patch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`:

```diff
+    public function __wakeup() {
+       throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__);
+    }
```

However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.

### References
_Are there any links users can visit to find out more?_
GitHub Security Advisory: GHSA-9qv6-4pwm-m68f
Package: ibexa/fieldtype-richtext (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.6.0-beta1, < 4.6.21
Patched in: 4.6.21

Summary: Ibexa RichText Field Type XSS vulnerabilities in back office

Details:
### Impact
This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
- See "Patched versions".
- https://github.com/ibexa/fieldtype-richtext/commit/4a4a170c7faa4807ae0f74c581481b835bab3caf

### Workarounds
None.
GitHub Security Advisory: GHSA-5r6x-g6jv-4v87
Package: ibexa/admin-ui (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.6.0-beta1, < 4.6.21
Patched in: 4.6.21

Summary: Ibexa Admin UI XSS vulnerabilities in back office

Details:
### Impact
This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
- See "Patched versions".
- https://github.com/ibexa/admin-ui/commit/72a64d90d249e5f4c4a5e8238f5d627c9b68d9b8

### Workarounds
None.
GitHub Security Advisory: GHSA-vhgq-r8gx-5fpv
Package: ibexa/admin-ui-assets (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.6.0-alpha1, < 4.6.21
Patched in: 4.6.21

Summary: Ibexa Admin UI assets XSS vulnerabilities in back office

Details:
### Impact
This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
- See "Patched versions".
- https://github.com/ibexa/admin-ui-assets/commit/219b71b70aaea9321947d2dbeb49fff1b49e05f4

### Workarounds
None.
GitHub Security Advisory: GHSA-r5rx-53g9-25rj
Package: ezsystems/ezplatform-admin-ui-assets (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.3.0-beta1, < 5.3.5
Patched in: 5.3.5

Summary: Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office

Details:
### Impact
This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
- See "Patched versions".
- https://github.com/ezsystems/ezplatform-admin-ui-assets/commit/219b71b70aaea9321947d2dbeb49fff1b49e05f4

### Workarounds
None.
GitHub Security Advisory: GHSA-r7pm-mw8g-p7px
Package: ezsystems/ezplatform-admin-ui (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0-beta1, < 2.3.38
Patched in: 2.3.38

Summary: Ibexa eZ Platform Admin UI XSS vulnerabilities in back office

Details:
### Impact
This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
- See "Patched versions".
- https://github.com/ezsystems/ezplatform-admin-ui/commit/acaa620d4ef44e7c20908dc389d48064f2c19e6d

### Workarounds
None.
GitHub Security Advisory: GHSA-2v3v-3whp-953h
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.3.0, < 3.3.1
Patched in: 3.3.1

Summary: starcitizentools/citizen-skin allows stored XSS in user registration date message

Details:
### Summary
Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

### Details
The result of `$this->lang->userDate( $timestamp, $this->user )` returns unescaped values, but is inserted as raw HTML by Citizen:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60

### PoC
1. Go to any page using citizen with the uselang parameter set to x-xss and while being logged in
Depending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's `november`:
![image](https://github.com/user-attachments/assets/252a3453-99c8-4ce1-b6d6-a8485b7a9a43)


### Impact
This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.
GitHub Security Advisory: GHSA-g3cp-pq72-hjpv
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.2, < 3.3.1
Patched in: 3.3.1

Summary: starcitizentools/citizen-skin allows stored XSS in menu heading message

Details:
### Summary
All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

### Details
The system messages for menu headings are inserted unescaped into raw HTML:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/templates/Menu.mustache#L8-L10

### PoC
1. Go to any article using citizen with the `uselang` parameter set to `x-xss`
2. A large number of alerts will be shown for various messages, e.g.:
![image](https://github.com/user-attachments/assets/6a18ec77-d2a0-4a0d-b4aa[PII_REDACTED]9a)
![image](https://github.com/user-attachments/assets/eaadb8e1-58b6-41be-90d2-829c50cf75ac)

On the main page of my test wiki, the following messages were shown: `navigation`, `notifications`, `user-interface-preferences`, `personaltools`, `variants`, `views`, `associated-pages`, `cactions` and `toolbox`.

### Impact
This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.
GitHub Security Advisory: GHSA-jwr7-992g-68mh
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.13.0, < 3.3.1
Patched in: 3.3.1

Summary: starcitizentools/citizen-skin allows stored XSS in preference menu heading messages

Details:
### Summary
Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

### Details
The `innerHtml` of the label div is set to the `textContent` of the label, essentially unsanitizing the system messages:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18


### PoC
1. Edit `citizen-feature-custom-font-size-name` (or any other message displayed in a heading in the preferences menu) to `<img src="" onerror="alert('citizen-feature-custom-font-size-name')">` (script tags don't work here due to the way the HTML is inserted)
2. Open the preferences menu
![image](https://github.com/user-attachments/assets/b75f100d-09cc-443c-b635-e9d6ab48d133)
GitHub Security Advisory: GHSA-86xf-2mgp-gv3g
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.31.0, < 3.3.1
Patched in: 3.3.1

Summary: starcitizentools/citizen-skin allows stored XSS in search no result messages

Details:
### Summary
The `citizen-search-noresults-title` and `citizen-search-noresults-desc` system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

### Details
The system messages are inserted as raw HTML by the mustache template:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.search/templates/TypeaheadPlaceholder.mustache#L8-L9


### PoC
1. Edit `citizen-search-noresults-title` and `citizen-search-noresults-desc` to `<img src="" onerror="alert('citizen-search-noresults-title')">` and `<img src="" onerror="alert('citizen-search-noresults-desc')">` (script tags don't work here due to the way the HTML is inserted)
2. Open the search bar and search for a page that doesn't exist to get the "no results" messages to show up

![image](https://github.com/user-attachments/assets/cf2963bc-5c86-4a4d-8574-de92d89d6d81)
![image](https://github.com/user-attachments/assets/44839a7e-c08c-4df9-bd84-0f5863f64163)


### Impact
This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.
GitHub Security Advisory: GHSA-4c2h-67qq-vm87
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.2, < 3.3.1
Patched in: 3.3.1

Summary: Citizen skin vulnerable to stored XSS through multiple system messages

Details:
### Summary
Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

### Details
The messages are retrieved using the `plain()` output mode: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L61-L66
`currentTip` is set to one of these messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L69
`currentTip` is inserted as raw HTML (`vue/no-v-html` should *not* be ignored here): https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L3-L4

### PoC
1. Edit `citizen-command-palette-tip-commands`, `citizen-command-palette-tip-users`, `citizen-command-palette-tip-namespace` and `citizen-command-palette-tip-templates` to `<img src="" onerror="alert(1)">` (script tags don't work here due to the way the HTML is inserted)
2. Open the command palette
![image](https://github.com/user-attachments/assets/f07b238b-1ac1-4781-8d03-db755ba04546)

### Impact
This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.
GitHub Security Advisory: GHSA-8vx9-hcvq-gfv8
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.0.0-beta.1
Patched in: 2.0.0-beta.2

Summary: MantisBT XSS through weak CSP when using Gravatar plugin

Details:
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
GitHub Security Advisory: GHSA-8vx9-hcvq-gfv8
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.3.0
Patched in: 1.3.1

Summary: MantisBT XSS through weak CSP when using Gravatar plugin

Details:
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
GitHub Security Advisory: GHSA-v7qf-22rw-chph
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.2.0, < 2.2.2
Patched in: 2.2.2

Summary: MantisBT XSS via adm_config_report.php's action parameter

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
GitHub Security Advisory: GHSA-v7qf-22rw-chph
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.1.2
Patched in: 2.1.2

Summary: MantisBT XSS via adm_config_report.php's action parameter

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
GitHub Security Advisory: GHSA-v7qf-22rw-chph
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.8
Patched in: 1.3.8

Summary: MantisBT XSS via adm_config_report.php's action parameter

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
GitHub Security Advisory: GHSA-x53v-v9xp-gf6g
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: MantisBT XSS via move_attachments_page.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
GitHub Security Advisory: GHSA-x53v-v9xp-gf6g
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.1.3
Patched in: 2.1.3

Summary: MantisBT XSS via move_attachments_page.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
GitHub Security Advisory: GHSA-x53v-v9xp-gf6g
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.9
Patched in: 1.3.9

Summary: MantisBT XSS via move_attachments_page.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
GitHub Security Advisory: GHSA-pwj7-5c7c-mwjc
Package: drupal/admin_audit_trail (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.0.5
Patched in: 1.0.5

Summary: Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation. This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.
GitHub Security Advisory: GHSA-w5px-5878-m9x4
Package: drupal/lightgallery (COMPOSER)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.6.0
Patched in: 1.6.0

Summary: Drupal Lightgallery Cross-site Scripting vulnerability

Details:
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS). This issue affects Lightgallery: from 0.0.0 before 1.6.0.
GitHub Security Advisory: GHSA-c424-hgg9-9c4w
Package: drupal/quick_node_block (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Drupal Quick Node Block Missing Authorization vulnerability

Details:
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing. This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
GitHub Security Advisory: GHSA-48wx-8736-jgx2
Package: drupal/commerce_alphabank_redirect (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability

Details:
Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse. This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.
GitHub Security Advisory: GHSA-q9h3-r6wr-p3j3
Package: drupal/commerce_eurobank_redirect (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.1.1
Patched in: 2.1.1

Summary: Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability

Details:
Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse. This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.
GitHub Security Advisory: GHSA-r6xj-43cf-9f88
Package: drupal/quick_node_block (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Drupal Quick Node Block Missing Authorization vulnerability

Details:
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing. This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
GitHub Security Advisory: GHSA-qghg-v7xv-q98q
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.25.5
Patched in: 2.25.5

Summary: MantisBT XSS through crafted SVG documents in file_download.php

Details:
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.
GitHub Security Advisory: GHSA-4w6c-3hcx-rfj5
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.