CVE-2014-9272: Debian Linux

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.

Affected products

• Debian Debian Linux: version 7.0 only
• Mantisbt Mantisbt: version 1.1.0 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; version 1.1.5 only; …

Published 2015-01-09. Last modified 2026-06-17.