Cloudanix VulnDB

CVE-2026-40607

Medium · 6.7

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

CVSS

6.7

EPSS

0.5%

Published

May 11, 2026

CISA due date

—

The record

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities