CVE-2008-4687: Mantis

High severity, CVSS 9.0. EPSS: 67.5% chance of exploitation in the next 30 days.

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php.

Affected products

• Mantis Mantis: up to and including 1.1.3; version 0.19.3 only; version 0.19.4 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; …

Published 2008-10-22. Last modified 2026-06-16.