For example, if product A, component X, version 1 (=AX1) and similarly BY2 selected, then the results also include those for AX2, AY1, BX1... etc.

The code line to be fixed is the following in search.php -
$querybuild['pcv'] = "AND bug.product IN (" . implode(',', $products) . ") AND bug.component IN (" . implode(',', $components) . ") AND bug.version IN (" . implode(',', $versions) . ")";
The problem is that the three IN conditions are independent from each other - elegant but incorrect.

Unfortunately it is necessary to generate each condition explicitly, e.g. as follows -
$qb = "AND (";
foreach ($products AS $pkey => $pvalue)
{
if ($pkey > 0)
{
$qb .= " OR ";
}
$qb .= "(bug.product=" . $pvalue;
if ($components[$pkey] != 0)
{
$qb .= " AND bug.component=" . $components[$pkey];
}
$qb .= " AND bug.version=" . $versions[$pkey] . ")";
}
$querybuild['pcv'] = $qb . ")";

The "if ($components[$pkey] != 0)" omits the component check for the product itself, i.e. if the main product rather than a component is selected then all results for components of that product are included - this may be a matter of taste, but we prefer it that way.