Yelin

A cross-site scripting (XSS) issue exists in the MantisBT Configuration Report page, allowing remote attackers to inject arbitrary code through a crafted `action` parameter in the adm config report.php page.