Dregad

An issue was discovered in MantisBT, where improper escaping of a `Plugin name` allows execution of arbitrary code in `manage plugin page.php` and `manage plugin uninstall.php` when a crafted plugin is installed, provided that the Content Security Policy (CSP) allows it.

The issue allows for Post Authentication Command Injection, which can lead to Remote Code Execution.

An access control issue allows users with "Reporter" permissions to change the status of any issue to "New".

A cross-site scripting issue exists in the configuration report page, allowing remote authenticated users to inject arbitrary web script or HTML via a complex value in the adm config report.php file.