CVE-2014-8987: Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (a...

Security readout for executives and security teams

CVE-2014-8987 is an administrator-access XSS issue in MantisBT. An administrator using the Configuration Report page could inject script or HTML through the configuration option field. Business risk is mainly in older MantisBT deployments where admin accounts are compromised, shared, or poorly controlled. Exposure is limited to organizations still running MantisBT 1.2.13 through 1.2.17. The reported attacker role is remote administrator, so internet exposure matters most when admin access is weak, reused, delegated broadly, or externally reachable. Treat this as a targeted legacy-platform risk. It is not described as mass-exploited, but affected MantisBT systems should be upgraded or patched, especially where admin access is internet-reachable or not tightly controlled. Mitigation focus: Inventory all MantisBT instances and identify versions 1.2.13 through 1.2.17.; Apply the MantisBT vendor fix referenced by the commit or upgrade per vendor guidance.; Restrict MantisBT administrator access to trusted users and protected networks..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.