CVE-2011-2938

Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.

• CWE-79

• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.htmlExploit, Patch
• http://packetstormsecurity.org/files/104149Exploit
• http://secunia.com/advisories/51199
• http://security.gentoo.org/glsa/glsa-201211-01.xml
• http://securityreason.com/securityalert/8391
• http://www.mantisbt.org/bugs/view.php?id=13245Exploit
• http://www.openwall.com/lists/oss-security/2011/08/18/7Exploit, Patch
• http://www.openwall.com/lists/oss-security/2011/08/19/16Exploit, Patch
• http://www.securityfocus.com/bid/49235Exploit
• https://bugs.gentoo.org/show_bug.cgi?id=379739Exploit, Patch
• https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857Exploit, Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=731777Exploit, Patch
• https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93bPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.htmlExploit, Patch
• http://packetstormsecurity.org/files/104149Exploit
• http://secunia.com/advisories/51199
• http://security.gentoo.org/glsa/glsa-201211-01.xml
• http://securityreason.com/securityalert/8391
• http://www.mantisbt.org/bugs/view.php?id=13245Exploit
• http://www.openwall.com/lists/oss-security/2011/08/18/7Exploit, Patch
• http://www.openwall.com/lists/oss-security/2011/08/19/16Exploit, Patch
• http://www.securityfocus.com/bid/49235Exploit
• https://bugs.gentoo.org/show_bug.cgi?id=379739Exploit, Patch
• https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857Exploit, Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=731777Exploit, Patch
• https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93bPatch

Published

Sep 21, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2932Cross-site scripting (XSS) vulnerability in activesupport/li…
• CVE-2011-2933An Arbitrary File Upload vulnerability exists in admin/media…7.2
• CVE-2011-2934A Cross Site Request Forgery (CSRF) vulnerability exists in …8.8
• CVE-2011-2935Elgg through 1.7.10 has XSS6.1
• CVE-2011-2936Elgg through 1.7.10 has a SQL injection vulnerability9.8
• CVE-2011-2937Cross-site scripting (XSS) vulnerability in the UI messages …
• CVE-2011-2939Off-by-one error in the decode_xs function in Unicode/Unicod…
• CVE-2011-2940stunnel 4.40 and 4.41 might allow remote attackers to execut…
• CVE-2011-2941Open redirect vulnerability in Red Hat JBoss Enterprise Port…
• CVE-2011-2942A certain Red Hat patch to the __br_deliver function in net/…
• CVE-2011-2943The irc_msg_who function in msgs.c in the IRC protocol plugi…
• CVE-2011-2944SQL injection vulnerability in login.php in MegaLab The Uplo…