CVE-2014-7146

CVE-2014-7146 describes a critical PHP code injection vulnerability in the XmlImportExport plugin of MantisBT versions 1.2.17 and earlier. Remote attackers can execute arbitrary PHP code by injecting malicious content into the description field or issuelink attribute of an XML file, which is then improperly processed by the preg_replace function. This vulnerability carries a CVSS score of 7.5, indicating high severity with network-based attacks, low complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit intelligence confirms the existence of Metasploit modules and ExploitDB entries, indicating readily available exploit code, despite limited community discussion or media coverage.