Mantisbt vulnerabilities

Products

• Mantisbt 140
• Source Integration 4

Newest

• mantisbt MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator CVE-2026-47156 Fix available 9.3 CriticalJuly 15, 2026
• mantisbt MantisBT: Stored XSS in File Download CVE-2026-44657 Fix available 7.5 HighMay 11, 2026
• mantisbt MantisBT: Stored XSS on Move Attachments Admin Page CVE-2026-44655 Fix available 8.6 HighMay 11, 2026
• mantisbt MantisBT: Private Bugnote Attachment Content Leak via REST API CVE-2026-42071 Fix available 7.2 HighMay 11, 2026
• mantisbt MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API CVE-2026-42070 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field CVE-2026-41897 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column CVE-2026-40607 Fix available 7.5 HighMay 11, 2026
• mantisbt MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page CVE-2026-40598 Fix available 6.9 MediumMay 11, 2026
• mantisbt MantisBT has a Content Security Policy bypass via attachments CVE-2026-40597 Fix available 7.6 HighMay 11, 2026
• mantisbt MantisBT is vulnerable to XSS and potential account takeover via user font family preference update CVE-2026-40596 Fix available 7.2 HighMay 11, 2026
• mantisbt MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values CVE-2026-39960 Fix available 5.4 MediumMay 11, 2026
• mantisbt MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked CVE-2026-34970 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT allows unauthorized users to upload attachments to restricted issues via REST API CVE-2026-34754 Fix available 4.3 MediumMay 11, 2026
• mantisbt MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues CVE-2026-34744 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT has an authorization bypass via private issue monitoring CVE-2026-34579 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT has Stored HTML Injection/XSS via Clone Issue Form CVE-2026-34463 Fix available 8.6 HighMay 11, 2026
• mantisbt MantisBT: Privilege Escalation from Manager to Administrator CVE-2026-34390 Fix available 5.1 MediumMay 11, 2026
• mantisbt MantisBT: Authorization Bypass in Global Profile Creation CVE-2026-33052 Fix available 5.3 MediumMay 11, 2026
• mantisbt MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline CVE-2026-33548 Fix available 8.6 HighMarch 23, 2026
• mantisbt MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation CVE-2026-33517 Fix available 8.6 HighMarch 23, 2026
• mantisbt MantisBT SOAP API has an authentication bypass vulnerability on MySQL CVE-2026-30849 Public exploitFix available 9.3 CriticalMarch 23, 2026
• mantisbt MantisBT unauthorized disclosure of private project column configuration CVE-2025-62520 Fix available 5.3 MediumNovember 3, 2025
• mantisbt MantisBT: Authentication bypass for some passwords due to PHP type juggling CVE-2025-55155 Fix available 5.4 MediumNovember 3, 2025
• mantisbt MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length CVE-2025-46556 Fix available 6.5 MediumNovember 3, 2025
• mantisbt MantisBT: Authentication bypass for some passwords due to PHP type juggling CVE-2025-47776 Fix available 8.8 HighNovember 3, 2025
• mantisbt MantisBT vulnerable to information disclosure with user profiles CVE-2024-45792 Fix available 5.3 MediumSeptember 30, 2024
• mantisbt MantisBT Cross-site Scripting vulnerability CVE-2024-34081 Fix available 6.6 MediumMay 13, 2024
• mantisbt MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-34080 Fix available 5.3 MediumMay 13, 2024
• mantisbt MantisBT user account takeover in the signup/reset password process CVE-2024-34077 Fix available 7.3 HighMay 13, 2024
• mantisbt MantisBT Host Header Injection vulnerability CVE-2024-23830 Fix available 8.3 HighFebruary 20, 2024
• mantisbt-plugins linkedcustomfields, mantisbt linked custom fields +1 more MantisBT LinkedCustomFields Cross-site Scripting vulnerability CVE-2023-49802 6.7 MediumDecember 11, 2023
• mantisbt Disclosure of project names to unauthorized users in MantisBT CVE-2023-44394 Fix available 4.3 MediumOctober 16, 2023
• mantisbt MantisBT: Exposure of Private issues' summary to unauthorized users CVE-2023-22476 Fix available 4.3 MediumFebruary 23, 2023
• mantisbt MantisBT XSS through crafted SVG documents in file_download.php CVE-2022-33910 Fix available 5.4 MediumJune 24, 2022
• mantisbt MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php CVE-2022-28508 Public exploit 6.1 MediumMay 4, 2022
• mantisbt MantisBT CSV Injection unprivileged user access in csv_export.php CVE-2021-43257 Fix available 7.8 HighApril 14, 2022
• mantisbt MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php CVE-2022-26144 Fix available 6.1 MediumApril 13, 2022
• mantisbt MantisBT allows XSS in manage_custom_field_edit_page.php CVE-2021-33557 Fix available 6.1 MediumJune 17, 2021
• mantisbt MantisBT Insufficient Session Expiration cookie string not reset after logout CVE-2009-20001 Fix available 8.1 HighMarch 7, 2021
• mantisbt MantisBT XSS in manage_custom_field_update.php CVE-2020-35571 Fix available 6.1 MediumFebruary 22, 2021
• mantisbt MantisBT Missing Authorization access check in bug_actiongroup.php CVE-2020-29604 Fix available 6.5 MediumJanuary 29, 2021
• mantisbt MantisBT Incorrect Authorization in bug_actiongroup_page.php CVE-2020-29605 Fix available 4.3 MediumJanuary 29, 2021
• mantisbt MantisBT Insecure Storage in manage_proj_edit_page.php CVE-2020-29603 Fix available 4.3 MediumJanuary 29, 2021
• mantisbt source integration An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker... CVE-2020-36192 5.3 MediumJanuary 18, 2021
• mantisbt MantisBT SQL Injection via mc_project_get_users function CVE-2020-28413 Public exploitFix available 5.3 MediumDecember 30, 2020
• mantisbt MantisBT Incorrect Authorization for bug_revision_view_page.php check CVE-2020-35849 Fix available 7.5 HighDecember 30, 2020
• mantisbt MantisBT HTML Injection vulnerability CVE-2020-25830 Fix available 4.8 MediumSeptember 30, 2020
• mantisbt MantisBT unauthorized users able to access private files CVE-2020-25781 Fix available 4.3 MediumSeptember 30, 2020
• mantisbt MantisBT XXS where a Custom Field with a crafted Regular Expression property is used CVE-2020-25288 Fix available 4.8 MediumSeptember 30, 2020
• mantisbt MantisBT XSS issue on the view_all_bug_page.php CVE-2020-16266 Fix available 5.4 MediumAugust 12, 2020
• Show olderLoading…