cbcvebase.
CVE-2014-9272
published 2015-01-09

CVE-2014-9272: The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to…

PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.99%
78.8th percentile
The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
mantisbtmantisbt——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.