CVE-2022-28508

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2022-05-04

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Mantisbt (Mantisbt)

References

• https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability
• https://mantisbt.org/
• https://sourceforge.net/projects/mantisbt/