CVE-2005-2556: Mantis

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses, as identified by bug#0005956.

Affected products

• Mantis Mantis: version 0.19.0 only; version 0.19.0_rc1 only; version 0.19.0a1 only; version 0.19.0a2 only; version 0.19.1 only; version 0.19.2 only; …

Published 2005-08-24. Last modified 2026-06-16.