[CRITICAL] MantisBT: Reflected XSS in admin/install.php via unescaped printf

PKSA-23vf-p9ny-hdcn CVE-2026-52881 GHSA-vcrw-4xvv-jh49

Affected package: mantisbt/mantisbt

Affected version: <=2.28.3

Reported by:
GitHub