CVE-2010-2802: Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.2 allows remote authenticated users to inje...

Security readout for executives and security teams

This CVE is a stored cross-site scripting issue in MantisBT before 1.2.2. An authenticated user could upload a misleading inline attachment that causes script or HTML to run in another user's browser when viewed. Business risk depends on whether old MantisBT instances still exist and allow untrusted users to upload attachments. Exposure is most likely in legacy MantisBT deployments older than 1.2.2 where authenticated non-admin users can upload and view inline attachments. Public issue trackers, customer portals, or partner-access systems increase practical risk. The bundle's structured affected-product data is incomplete, but the description and references identify MantisBT before 1.2.2. Treat this as a moderate legacy-application risk. It is not supported here as actively exploited, but old externally accessible MantisBT portals with broad user access should be upgraded promptly because XSS can affect user sessions and trust in the issue tracker. Mitigation focus: Upgrade MantisBT to version 1.2.2 or later.; Review MantisBT vendor issue and release notes for any supported workarounds.; Restrict attachment upload rights for untrusted authenticated users until upgraded..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.