CVE-2005-3335

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-27 · updated 2026-06-16

Description

PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.

Affected products

mantis: 0.19.2, 1.0.0_rc2

References

http://bugs.mantisbt.org/changelog_page.php
http://secunia.com/advisories/16506
http://secunia.com/advisories/16818
http://secunia.com/advisories/17362
http://secunia.com/advisories/17654
http://secunia.com/secunia_research/2005-46/advisory/
http://securityreason.com/securityalert/121
http://securitytracker.com/id?1015110
http://www.debian.org/security/2005/dsa-905
http://www.gentoo.org/security/en/glsa/glsa-200510-24.xml
http://www.securityfocus.com/bid/15212
http://www.securityfocus.com/bid/15227

Get alerted when CVE-2005-3335 or the next vulnerability affects your stack