CVE-2004-1734: Mantis

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2) t_core_dir parameter to relationship_api.php to reference a URL on a remote web server that contains the code.

Affected products

• Mantis Mantis: version 0.19.0a only

Published 2004-12-31. Last modified 2026-06-16.