It is possible to embed an XSS script into the project name at creation. This then shows up in several other pages.

From Thomas Waldegger [thomas.waldegger at morph3us dot org]

You should not allow users to add projects, filters, users and so on
with HTML/Script code in it.

Note: These configurations affect only the ">'' project.

Try to add a project with the name '">script>alert(document.cookie)
</script>' and have a look at following PHP files:

/manage_config_work_threshold_page.php
/manage_config_email_page.php
/manage_config_work_threshold_page.php
/changelog_page.php:
/print_all_bug_page.php:

These files do not filter the project name and so everytime a certain
PHP file is loaded the JavaScript code gets executed. It's a harmless
bug, I know, but Mantis should handle this.