CVE-2026-39960

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution.

• CWE-79

• https://github.com/mantisbt/mantisbt/commit/5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-qj6w-v29q-4rgx

Published

May 20, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39955Cacti is an open source performance and fault management fra…9.8
• CVE-2026-39956jq is a command-line JSON processor. In commits after 69785b…6.1
• CVE-2026-39957Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-39958oma is a package manager for AOSC OS. Prior to 1.25.2, oma-t…9.1
• CVE-2026-39959Tmds.DBus provides .NET libraries for working with D-Bus fro…7.1
• CVE-2026-3996The WP Games Embed plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-39961Aiven Operator allows you to provision and manage Aiven Serv…4.9
• CVE-2026-39962MISP is an open source threat intelligence and sharing platf…9.6
• CVE-2026-39963Serendipity is a PHP-powered weblog engine. In versions 2.6-…6.9
• CVE-2026-39964TypeBot is a chatbot builder tool. In versions prior to 3.16…5.4
• CVE-2026-39965TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…7.7
• CVE-2026-39966TypeBot is a chatbot builder tool. In versions 3.15.2, the g…6.5