Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
MantisBT 跨站脚本漏洞
Vulnerability Description
MantisBT是MantisBT团队的一套基于Web的开源缺陷跟踪系统。该系统以Web操作的形式提供项目管理及缺陷跟踪服务。 MantisBT 1.1.0a1版本至1.2.18之前1.2.x版本的‘file_download.php’函数中存在安全漏洞，该漏洞源于程序没有正确验证URL协议。远程攻击者可借助javascript://协议利用该漏洞实施跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A