What’s Vulnerable › Vulnerabilities

CVE-2019-15074

• Severity: critical (CVSS 9.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-08-21 · updated 2026-06-17
• Weakness: CWE-79

Description

The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.

Affected products

• mantisbt: from 2.13.0 through 2.21.1

References

• https://github.com/mantisbt/mantisbt/commit/9cee1971c498bbe0a72bca1c773fae50171d8c27
• https://mantisbt.org/bugs/view.php?id=25995
• https://github.com/mantisbt/mantisbt/commit/9cee1971c498bbe0a72bca1c773fae50171d8c27
• https://mantisbt.org/bugs/view.php?id=25995

Get alerted when CVE-2019-15074 or the next vulnerability affects your stack