CVE-2019-15539

—

CVSS 3.1

6.1 medium

EPSS

1%p65

Published

Mar 19, 2020 (Mar 19, 2020)

Modified

Jun 17, 2026

Description

The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.

Vendors: mantisbt
Products: mantisbt
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.