CVE-2014-9281

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows...

4.3 Medium

CVE-2014-9281 is a medium vulnerability (CVSS 4.3) in Mantisbt, published December 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.38%, the 84th percentile. No source names a fixed version.

What does this mean?

Severity: 4.3 MediumCVSS 2.0, NVD
Exploit chance: 2.38%EPSS, 84th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.

Exploit likelihood

2.38%Up 0.6 points since Feb 4, 2022

Affected products

mantisbt

Affected packages

Affected packages
Package	Affected	Fixed
`mantis` Debian:7 From an advisory covering 21 CVEs	before 1.2.18-1, plus listed versions 1.2.11-1.21.2.11-1.2+deb7u1	1.2.18-1

What each source reports

NVD Score used4.3

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.

Record: CVE-2014-9281
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE ListNo score

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.

Record: CVE-2014-9281
Updated: 2026-11-02

EUVDEUVD-2014-9106No score

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.

Record: EUVD-2014-9106
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r7gx-6pwm-3xc3No score

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows...

Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field.

Record: GHSA-r7gx-6pwm-3xc3
Weakness: CWE-79
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less