deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4w6c-3hcx-rfj5
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.1.3
Patched in: 2.1.3

Summary: MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
GitHub Security Advisory: GHSA-4w6c-3hcx-rfj5
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.9
Patched in: 1.3.9

Summary: MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
GitHub Security Advisory: GHSA-w93w-rx52-24qh
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.5.2
Patched in: 2.5.2

Summary: MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php

Details:
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.
GitHub Security Advisory: GHSA-wfg2-2wmw-6894
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.25.2
Patched in: unpatched

Summary: MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php

Details:
An XSS issue was discovered in browser_search_plugin.php in MantisBT up to and including 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
GitHub Security Advisory: GHSA-rqgj-rqfr-5j6f
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.25.2
Patched in: 2.25.3

Summary: MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php

Details:
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.
GitHub Security Advisory: GHSA-hxrr-x32w-cg8g
Package: elmsln/haxcms (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: < 11.0.0
Patched in: 11.0.0

Summary: HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Details:
### Summary
An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

### Details
The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in[ HAXCMSSite.php line 1248](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/HAXCMSSite.php#L1248) to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

### PoC
1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

<img width="839" alt="LFI" src="https://github.com/user-attachments/assets/91b1bb7f-9248-40d2-81fc-f839beb4d39c" />

3. Curl the website root to see the file contents.

![passwd](https://github.com/user-attachments/assets/21adbb00-8e57-48f6-b1e9-f5b03ec65b55)


### Impact
This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.
GitHub Security Advisory: GHSA-2vc4-3hx7-v7v7
Package: elmsln/haxcms (COMPOSER)
Severity: HIGH (CVSS 8.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: < 11.0.0
Patched in: 11.0.0

Summary: Hax CMS Stored Cross-Site Scripting vulnerability

Details:
### Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

### Affected Resources

- [Operations.php:258](https://github.com/haxtheweb/haxcms-php/blob/master/system/backend/php/lib/Operations.php#L258) `saveManifest()`
- [Operations.php:868](https://github.com/haxtheweb/haxcms-php/blob/master/system/backend/php/lib/Operations.php#L868) `saveNode()`
- `https://<site>/<user>/system/api/saveNode`
- `https://<site>/<user>/system/api/saveManifest`

### Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

### PoCs

#### saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

![image](https://github.com/user-attachments/assets/c22c52e6-079a-4add-94a2-b51b1a925a96)

3. Select "Update HTML" and observe the resulting alert.

![image](https://github.com/user-attachments/assets/df2da026-de47-4f65-bbc2-c4dbc8fb77e5)

![image](https://github.com/user-attachments/assets/d593418c-73c6-4210-953e-faca8405174c)

#### saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

![image](https://github.com/user-attachments/assets/f7faa998-58ec-4085-9c65-d6a9f3831587)

3. Add JavaScript code to the URL field under the "Theme" header.

![image](https://github.com/user-attachments/assets/a99a7238-bb63-408c-8ca7-22deaffeca83)

5. Reload the page to run the script.

![image](https://github.com/user-attachments/assets/e634b1f3-58c1-44f6-8c8a-814773e69e83)

7. The resulting page source will contain the script.

![image](https://github.com/user-attachments/assets/a022d9d2-a6bf-41ad-a9f2-44a6a2f0fa07)
GitHub Security Advisory: GHSA-j226-63j7-qrqh
Package: barryvdh/laravel-translation-manager (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.6.8
Patched in: 0.6.8

Summary: Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Details:
### Impact
The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities.

### Patches
The issue is fixed in https://github.com/barryvdh/laravel-translation-manager/pull/475 which is released in version 0.6.8

### Workarounds
Only authenticated users with access to the translation manager are impacted.

### References
[[PT-2025-04] laravel translation manager.pdf](https://github.com/user-attachments/files/20639250/PT-2025-04.laravel.translation.manager.pdf)

### Reported by
Positive Technologies (Artem Deikov, Ilya Tsaturov, Daniil Satyaev, Roman Cheremnykh, Artem Danilov, Stanislav Gleym)
GitHub Security Advisory: GHSA-c42h-56wx-h85q
Package: auth0/login (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 7.0.0-BETA1, <= 7.2.1
Patched in: 7.2.2

Summary: laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Details:
**Overview**
The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.


**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:

1. Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1.
2. Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

**Fix**
Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).

**Acknowledgement**
Okta would like to thank Andreas Forsblom for discovering this vulnerability.
GitHub Security Advisory: GHSA-98j6-67v3-mw34
Package: auth0/symfony (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.0.0-BETA0, <= 5.0.0
Patched in: 5.1.0

Summary: Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Details:
**Overview**
The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.


**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0. 
2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

**Fix**
Upgrade Auth0/symfony to the latest version (v5.4.0).

**Acknowledgement**
Okta would like to thank Andreas Forsblom for discovering this vulnerability.
GitHub Security Advisory: GHSA-g3p6-82vc-43jh
Package: yiisoft/yii2-redis (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 2.0.20
Patched in: 2.0.20

Summary: Yii 2 Redis may expose AUTH parameters in logs in case of connection failure

Details:
### Impact

On failing connection extension writes commands sequence to logs. AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs.
GitHub Security Advisory: GHSA-862m-5253-832r
Package: auth0/wordpress (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.0.0-BETA0, <= 5.0.1
Patched in: 5.1.0

Summary: Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Details:
**Overview**
The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1. 
2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

**Fix**
Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).
GitHub Security Advisory: GHSA-8r2m-qhff-jm2c
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 2.3.2
Patched in: 2.3.2

Summary: MantisBT XSS via my_view_page.php and view_user_page.php

Details:
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
GitHub Security Advisory: GHSA-v9m8-9xxp-q492
Package: auth0/auth0-php (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 8.0.0-BETA3, < 8.3.1
Patched in: 8.3.1

Summary: Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

Details:
**Overview**
The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0-PHP SDK, versions between 8.0.0-BETA3 to 8.3.0. 
2. Applications using the following SDKs that rely on the Auth0-PHP SDK versions between 8.0.0-BETA3 to 8.3.0:
    a. Auth0/symfony,
    b. Auth0/laravel-auth0,
    c. Auth0/wordpress.

**Fix**
Upgrade Auth0/Auth0-PHP to 8.3.1.

**Acknowledgement**
Okta would like to thank Andreas Forsblom for discovering this vulnerability.
GitHub Security Advisory: GHSA-2pcj-76hj-xqhm
Package: bcit-ci/codeigniter (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 3.1.3
Patched in: 3.1.3

Summary: CodeIgniter arbitrary code execution

Details:
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.
GitHub Security Advisory: GHSA-74gh-5j33-vg4w
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.15.0
Patched in: 2.15.1

Summary: MantisBT allows XSS on the Edit Filter page via crafted filter name

Details:
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').
GitHub Security Advisory: GHSA-mjp7-97w4-jwhc
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.15.1
Patched in: 2.15.1

Summary: MantisBT allows XSS via View Filters page 

Details:
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
GitHub Security Advisory: GHSA-ggjm-7m5f-7xjv
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.17.2
Patched in: 2.17.2

Summary: MantisBT allows XSS via the Manage Filter page 

Details:
A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
GitHub Security Advisory: GHSA-gcqw-45xq-xc63
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.17.2
Patched in: 2.17.2

Summary: MantisBT allows XSS via Edit Filter page 

Details:
A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
GitHub Security Advisory: GHSA-98xr-mmq5-vc5h
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.5.2
Patched in: 2.5.2

Summary: MantisBT XSS allows unsanitized input via admin/install.php

Details:
An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.
GitHub Security Advisory: GHSA-98xr-mmq5-vc5h
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.3.11
Patched in: 1.3.12

Summary: MantisBT XSS allows unsanitized input via admin/install.php

Details:
An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.
GitHub Security Advisory: GHSA-rg8f-5p7x-m6wv
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 7.8)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: <= 2.25.2
Patched in: 2.25.3

Summary: MantisBT CSV Injection unprivileged user access in csv_export.php

Details:
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
GitHub Security Advisory: GHSA-cvrm-cr3m-qj92
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.24.5
Patched in: 2.25.0

Summary: MantisBT XSS in manage_custom_field_update.php

Details:
An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
GitHub Security Advisory: GHSA-pgg9-mmcg-8mxp
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.24.4
Patched in: 2.24.4

Summary: MantisBT Incorrect Authorization in bug_actiongroup_page.php

Details:
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (The target Issues can have Private view status, or belong to a private Project.)
GitHub Security Advisory: GHSA-qpj5-f88q-x7px
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-922: Insecure Storage of Sensitive Information
Vulnerable versions: < 2.24.4
Patched in: 2.24.4

Summary: MantisBT Insecure Storage in manage_proj_edit_page.php

Details:
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
GitHub Security Advisory: GHSA-f38c-wxp6-8xjv
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.24.4
Patched in: 2.24.4

Summary: MantisBT Missing Authorization access check in bug_actiongroup.php

Details:
An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bug_arr[] parameter. This provides full access to potentially confidential information.
GitHub Security Advisory: GHSA-7j8m-fm49-xgmg
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2.24.3
Patched in: 2.24.4

Summary: MantisBT Incorrect Authorization for bug_revision_view_page.php check

Details:
An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnote_id parameter.
GitHub Security Advisory: GHSA-52cx-vphc-jmjm
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.25.1
Patched in: 2.25.2

Summary: MantisBT allows XSS in manage_custom_field_edit_page.php

Details:
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
GitHub Security Advisory: GHSA-49w9-82cj-xr48
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.24.3
Patched in: 2.24.4

Summary: MantisBT SQL Injection via mc_project_get_users function

Details:
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.