Mantis Bugtracker Multiple XSS and Email Bomber Vulnerabilities

The following is key vulnerability information extracted from the webpage screenshot: Vulnerability Overview Software Name: Mantis Bugtracker Vulnerability Category: Multiple Cross-Site Scripting (XSS) vulnerabilities and a potential Email Bombing (E-Mail Bomber) vulnerability Detailed Vulnerability Description A. Multiple Cross-Site Scripting (XSS) Vulnerabilities 1. XSS Vulnerability on Login Page - When logging in anonymously and attempting privileged operations, the previous URL is passed via the parameter in the script. - If the parameter is not properly sanitized, attackers can inject arbitrary HTML/script code. - Test URL: 2. XSS Vulnerability during User Registration - The script does not properly sanitize incoming email addresses when displaying or parsing them. - Registration page test steps: - Navigate to - Enter any username in the username field. - Enter an email like or in the email field. 3. XSS Vulnerability in Project Selection - Test URL: 4. Other XSS Vulnerabilities - Test URL: B. Potential Email Bombing Vulnerability Attackers can send a large number of emails to the same address by simply modifying the username. Example script can be used to perform email bombing. Remediation The vendor has been contacted, and all vulnerabilities have been fixed in the CVS version on the SourceForge.net site. Contact Information Contact Person: Josean Koret Email: joxeanpitiyah00es

Goal Reached Thanks to every supporter — we hit 100%!

Mantis Bugtracker Multiple XSS and Email Bomber Vulnerabilities