[mantis multiple issues fixed in 1.0.7]
"email notifications bypass security on custom fields" and "XSS vulnerabilities"
