MantisBT has a Private Bugnote Attachment Content Leak via REST API
CVE-2026-42071
A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to downlo
#severity:high
共收录 5513 条相关情报。
← 返回所有主题MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column
CVE-2026-40607
Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_r
MantisBT has a Content Security Policy bypass via attachments
CVE-2026-40597
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
CVE-2026-40596
Any authenticated user can inject arbitrary HTML via updating their account's font family. ### Impact Cross-site script
Yii 2: Local file inclusion via view parameter name collision
CVE-2026-39850
The core view rendering method `View::renderPhpFile()` calls `extract($_params_, EXTR_OVERWRITE)` before the `require` s
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
CVE-2026-34463
When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepen
A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function...
CVE-2026-8260
A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of th
memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the...
CVE-2021-47944
memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting
Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated...
CVE-2021-47939
Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation
Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog...
CVE-2021-47945
Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to...
CVE-2021-47949
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files an
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to...
CVE-2022-50944
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP
Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the...
CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handle
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows...
CVE-2021-47928
Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to ext
WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows...
CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to
ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative...
CVE-2021-47938
ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows au
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers...
CVE-2021-47935
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co
TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated...
CVE-2021-47943
TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbi
e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users...
CVE-2021-47937
e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation pe
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability...
CVE-2026-8234
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWif