Vulnerabilities

TI-2026-25939 CVE-2026-33548 · GHSA-73vx-49mv-v8w5

MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline

LOW 39

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00199 Published 2026-03-23 Fixed in 2.28.2 CWE-79

TI-2026-25913 CVE-2026-33517 · GHSA-fh48-f69w-7vmp

MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation

LOW 39

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00247 Published 2026-03-23 Fixed in 2.28.1 CWE-79

TI-2026-23678 CVE-2026-30849 · GHSA-phrq-pc6r-f6gh

MantisBT SOAP API has an authentication bypass vulnerability on MySQL

MEDIUM 52

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0176 Published 2026-03-23 Fixed in 2.28.1 CWE-305

TI-2025-38760 CVE-2025-62520 · GHSA-g582-8vwr-68h2

MantisBT unauthorized disclosure of private project column configuration

MEDIUM 57

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00264 Published 2025-11-04 Fixed in 2.27.2 CWE-285

TI-2025-34837 CVE-2025-55155 · GHSA-q747-c74m-69pr

MantisBT: Authentication bypass for some passwords due to PHP type juggling

LOW 24

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00163 Published 2025-11-04 Fixed in 2.27.2 CWE-201

TI-2025-30241 CVE-2025-47776 · GHSA-4v8w-gg5j-ph37

MantisBT: Authentication bypass for some passwords due to PHP type juggling

MEDIUM 44

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00345 Published 2025-11-04 Fixed in 2.27.2 CWE-305

TI-2025-29273 CVE-2025-46556 · GHSA-r3jf-hm7q-qfw5

MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length

LOW 33

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00411 Published 2025-11-04 Fixed in 2.27.2 CWE-770

TI-2024-30759 CVE-2024-45792 · GHSA-h5q3-fjp4-2x7r

MantisBT vulnerable to information disclosure with user profiles

LOW 25

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0053 Published 2024-09-30 Fixed in 2.26.4 CWE-200

TI-2024-22538 CVE-2024-34081 · GHSA-wgx7-jp56-65mq

MantisBT Cross-site Scripting vulnerability

LOW 30

MantisBT (Mantis Bug Tracker) is an open source issue tracker.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00642 Published 2024-05-13 Fixed in 2.26.2 CWE-79

TI-2024-22537 CVE-2024-34080 · GHSA-99jc-wqmr-ff2q

MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

LOW 31

MantisBT (Mantis Bug Tracker) is an open source issue tracker.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00698 Published 2024-05-13 Fixed in 2.26.2 CWE-200

TI-2024-22534 CVE-2024-34077 · GHSA-93x3-m7pw-ppqm

MantisBT user account takeover in the signup/reset password process

MEDIUM 40

MantisBT (Mantis Bug Tracker) is an open source issue tracker.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.01186 Published 2024-05-13 Fixed in 2.26.2 CWE-305

TI-2024-15824 CVE-2024-23830 · GHSA-mcqj-7p29-9528

MantisBT Host Header Injection vulnerability

LOW 38

MantisBT is an open source issue tracker.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00962 Published 2024-02-20 Fixed in 2.26.1 CWE-74

TI-2023-23900 CVE-2023-44394 · GHSA-v642-mh27-8j6m

Disclosure of project names to unauthorized users in MantisBT

LOW 21

MantisBT is an open source bug tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0074 Published 2023-10-16 Fixed in 2.25.8 CWE-200

TI-2023-08725 CVE-2023-22476 · GHSA-hf4x-6h87-hm79

MantisBT: Exposure of Private issues' summary to unauthorized users

MEDIUM 53

Mantis Bug Tracker (MantisBT) is an open source issue tracker.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00608 Published 2023-02-23 Fixed in 2.25.6 CWE-200

TI-2022-14916 CVE-2022-33910 · GHSA-qghg-v7xv-q98q

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted…

LOW 26

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00948 Published 2022-06-24 Fixed in 2.25.5 CWE-79

TI-2022-11209 CVE-2022-28508 · GHSA-wfg2-2wmw-6894

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2.

LOW 35

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0517 Published 2022-05-04 No fix listed CWE-79

TI-2021-19258 CVE-2021-43257 · GHSA-rg8f-5p7x-m6wv

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3…

LOW 36

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00979 Published 2022-04-14 Fixed in 2.25.3 CWE-1236

TI-2022-09602 CVE-2022-26144 · GHSA-rqgj-rqfr-5j6f

An XSS issue was discovered in MantisBT before 2.25.3.

LOW 29

An XSS issue was discovered in MantisBT before 2.25.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00835 Published 2022-04-13 Fixed in 2.25.3 CWE-79

TI-2021-12951 CVE-2021-33557 · GHSA-52cx-vphc-jmjm

An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before…

LOW 31

An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01825 Published 2021-06-17 Fixed in 2.25.2 CWE-79

TI-2009-04911 CVE-2009-20001 · GHSA-jm72-67rm-763j

An issue was discovered in MantisBT before 2.24.5.

LOW 37

An issue was discovered in MantisBT before 2.24.5.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00871 Published 2021-03-07 Fixed in 2.24.5 CWE-613

TI-2020-18078 CVE-2020-35571 · GHSA-cvrm-cr3m-qj92

An issue was discovered in MantisBT through 2.24.3.

LOW 28

An issue was discovered in MantisBT through 2.24.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00662 Published 2021-02-22 Fixed in 2.25.0 CWE-79

TI-2020-17786 CVE-2020-29604 · GHSA-f38c-wxp6-8xjv

An issue was discovered in MantisBT before 2.24.4.

LOW 31

An issue was discovered in MantisBT before 2.24.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01124 Published 2021-01-29 Fixed in 2.24.4 CWE-862

TI-2020-17787 CVE-2020-29605 · GHSA-pgg9-mmcg-8mxp

An issue was discovered in MantisBT before 2.24.4.

LOW 22

An issue was discovered in MantisBT before 2.24.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00903 Published 2021-01-29 Fixed in 2.24.4 CWE-863

TI-2020-17785 CVE-2020-29603 · GHSA-qpj5-f88q-x7px

In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user…

LOW 22

In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01057 Published 2021-01-29 Fixed in 2.24.4 CWE-922

TI-2020-17238 CVE-2020-28413 · GHSA-49w9-82cj-xr48

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the…

LOW 36

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04782 Published 2020-12-30 Fixed in 2.24.4 CWE-89

Vulnerabilities

Filters