MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
CVE-2026-42070
The mc_issue_update() function in MantisBT allows users having *update_bug_threshold* access (UPDATER, with default sett
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
CVE-2026-41897
Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Pag
Mermaid: Improper sanitization of configuration leads to CSS injection
CVE-2026-41159
### Impact Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fo
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
CVE-2026-41150
### Impact Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if th
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
CVE-2026-41149
### Impact Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
CVE-2026-41148
### Details The state diagram and any other diagram type that routes user-controlled style strings through createCssSty
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
CVE-2026-40598
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject H
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
CVE-2026-39960
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacke
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
CVE-2026-34970
MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. #
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
CVE-2026-34754
### Impact MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to acce
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
CVE-2026-34744
MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after tha
MantisBT has an authorization bypass in private issue monitoring
CVE-2026-34579
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor fo
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
CVE-2026-34390
Insufficient access control checks in _ProjectUsersAddCommand_ (used in *manage_proj_user_add.php* and REST API endpoint
MantisBT Has Authorization Bypass in Global Profile Creation
CVE-2026-33052
MantisBT allows a low-privileged authenticated user having *add_profile_threshold* to create a global profile despite no
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage...
CVE-2022-50968
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_create
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend...
CVE-2022-50969
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The d
WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows...
CVE-2022-50970
WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers t
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage...
CVE-2022-50966
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, d
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated...
CVE-2021-47947
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject mal
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting...
CVE-2022-50947
WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows