Loading story…
Mantis Bug Tracker (MantisBT) fixed two high-severity vulnerabilities in version 2.28.1, including an authentication bypass in the SOAP API tracked as CVE-2026-30849. On MySQL-family databases, improper type checking of the password parameter lets an attacker who knows a victim's username authenticate without the real password by sending a crafted SOAP request, then invoke any SOAP API function available to that account. The issue is specific to MySQL-related implicit string-to-integer conversion behavior; other supported database backends are not affected in the same way. Disabling the SOAP API can reduce risk, but advisories note that some user account information such as email addresses and real names may still remain exposed.
MantisBT 2.28.0 also contains a stored HTML injection flaw, CVE-2026-33548, in the Timeline view on my_view_page.php. The bug stems from improper escaping of tag names pulled from History, allowing HTML injection—and potentially arbitrary JavaScript execution if Content Security Policy settings permit—when renamed or deleted tags are displayed. The vendor addressed the issue in 2.28.1 and published workarounds that include cleaning affected History entries in SQL and updating code to use string_html_specialchars() in IssueTagTimelineEvent::html(). Together, the flaws expose MantisBT deployments to account compromise through the API and client-side code execution in the web interface.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A public advisory disclosed CVE-2026-33517, a stored HTML injection/XSS flaw in MantisBT 2.28.0's tag_delete.php deletion confirmation message that could allow authenticated attackers to inject HTML or JavaScript. The issue was fixed in MantisBT 2.28.1, with workarounds including reverting a related commit or removing the %1$s placeholder from the tag deletion message string.
Public advisories dated March 23, 2026 disclosed details for CVE-2026-33548 and CVE-2026-30849, including affected versions, impact, and available mitigations or workarounds.
GitHub Security Advisories newly received CVE-2026-33548 on March 23, 2026, documenting the stored HTML injection/XSS vulnerability in MantisBT Timeline tag handling.
MantisBT addressed both vulnerabilities in version 2.28.1, fixing improper escaping of tag names in Timeline view and the SOAP API password type-checking issue on MySQL-family databases.
Mantis Bug Tracker version 2.28.0 was affected by two vulnerabilities: a stored HTML injection/XSS issue in Timeline tag display and a SOAP API authentication bypass affecting MySQL-family deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Canadian Centre for Cyber Security warned that **MISP CTI-Transmute** versions `<= 1.4.0` are affected by multiple vulnerabilities, including **CVE-2026-69082** and **CVE-2026-69079`. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because `/account/delete/<id>` accepted HTTP `GET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted. A second high-severity flaw allows **unauthenticated denial of service** through the `/activity_timeline` endpoint, where an unbounded `days` parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require `POST` plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Aug 4, 2026
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
MISP deployments running versions earlier than **2.5.48** are affected by multiple security vulnerabilities, including a critical TOTP MFA replay flaw (`CVE-2026-103655`) and high-severity authorization and mass-assignment issues. A user with `perm_tag_editor` could inject User or Organisation data through tag-collection saves to create or alter privileged accounts (`CVE-2026-103239`), while a user with `perm_delegate` could retarget event delegations to arbitrary events and potentially gain access to another organisation’s threat-intelligence data (`CVE-2026-103235`). The TOTP flaw permits reuse of an intercepted valid authentication code within its normal validity window, enabling an additional session as the victim. The update also binds delegation requests to authorized events and prevents nested model aliases or tag-collection save requests from modifying unrelated database rows. Authorities including Italy’s ACN and the Canadian Centre for Cyber Security urged administrators to apply the available MISP update, review audit logs for unauthorized user, organisation, delegation, and role changes, and validate permissions. Separately, MISP’s recent hardening releases addressed a broader set of defects—including XSS, SSRF, local-file-read, access-control, and authenticated remote-code-execution issues—following an external security review; administrators should ensure they are running the latest fixed release, particularly where MFA and delegation are enabled.
Oct 1, 2026