{"action":"Upgrade mantisbt/mantisbt to 2.28.4 or later.","affected":[{"fixed":"2.28.4","introduced":"0"}],"component":"mantisbt/mantisbt","cve_ids":["CVE-2026-47142"],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.28.4"],"ghsa_id":"GHSA-mw6p-33vw-46cc","id":"tcs_01M5KF5WFYTWB76X7DV1PERR4N","modified_at":"2026-07-15T16:56:40.831437Z","published_at":"2026-07-15T16:38:22Z","references":["https://osv.dev/vulnerability/GHSA-mw6p-33vw-46cc","https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mw6p-33vw-46cc","https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325","https://github.com/mantisbt/mantisbt","https://mantisbt.org/bugs/view.php?id=37123"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-mw6p-33vw-46cc","url":"https://osv.dev/vulnerability/GHSA-mw6p-33vw-46cc"}],"summary":"MantisBT: SQL Injection via history_order Configuration Value"}