Login Request a demo
MA
Product
mantisbt
by mantisbt · last CVE Sep 9, 2026
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities140In the news0Timeline
Severity mix
Critical 4High 16Medium 65Low 1
Severity
All severities140Critical4High16Medium65Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add mantisbt to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-30849
9.8
2%
Mar 23
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
Affected: < 2.28.1
CVE-2019-15074
9.6
2%
Aug 21
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
Affected: 2.13.0 through 2.21.1
CVE-2026-47156
9.3
1%
Sep 9
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
Affected: < 2.28.4
CVE-2025-47776
9.1
0%
Nov 4
MantisBT: Authentication bypass for some passwords due to PHP type juggling
Affected: < 2.27.2
CVE-2017-7615
8.8
91%
Apr 16
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php
Affected: through 2.3.0
CVE-2026-44655
8.6
0%
May 28
MantisBT: Stored XSS on Move Attachments Admin Page
Affected: >= 1.3.0, < 2.28.2
CVE-2026-34463
8.6
0%
May 19
MantisBT has Stored HTML Injection/XSS via Clone Issue Form
Affected: < 2.28.2
CVE-2024-23830
8.3
1%
Feb 20
MantisBT is an open source issue tracker
Affected: before 2.26.1
CVE-2009-20001
8.1
1%
Mar 7
An issue was discovered in MantisBT before 2.24.5
Affected: before 2.24.5
CVE-2021-43257
7.8
1%
Apr 14
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens…
Affected: before 2.25.3
CVE-2026-40597
7.6
0%
May 22
MantisBT has a Content Security Policy bypass via attachments
Affected: < 2.28.2
CVE-2026-44657
7.5
0%
May 28
MantisBT: Stored XSS in File Download
Affected: < 2.28.2
CVE-2026-40607
7.5
0%
May 22
MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column
Affected: >= 2.1.0, < 2.28.2
CVE-2025-46556
7.5
0%
Nov 4
MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length
Affected: < 2.27.2
CVE-2020-35849
7.5
2%
Dec 30
An issue was discovered in MantisBT before 2.24.4
Affected: before 2.24.4
CVE-2014-9624
7.5
3%
Sep 12
CAPTCHA bypass vulnerability in MantisBT before 1.2.19
Affected: through 1.2.18
CVE-2024-34077
7.3
1%
May 13
MantisBT user account takeover in the signup/reset password process
Affected: < 2.26.2
CVE-2026-42071
7.2
0%
May 28
MantisBT: Private Bugnote Attachment Content Leak via REST API
Affected: >= 2.23.0, < 2.28.2
CVE-2026-40596
7.2
0%
May 22
MantisBT is vulnerable to XSS and potential account takeover via user font family preference update
Affected: >= 2.11.0, < 2.28.2
CVE-2019-15715
7.2
30%
Oct 9
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution
Affected: 1.0.0 before 1.3.20; 2.0.0 before 2.22.1
CVE-2026-40598
6.9
0%
May 22
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Affected: < 2.28.2
CVE-2024-45792
6.5
1%
Sep 30
MantisBT vulnerable to information disclosure with user profiles
Affected: < 2.26.4
CVE-2020-29604
6.5
1%
Jan 29
An issue was discovered in MantisBT before 2.24.4
Affected: before 2.24.4
CVE-2020-28413
6.5
5%
Dec 30
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP
Affected: 2.24.3
CVE-2018-9839
6.5
1%
Jun 6
An issue was discovered in MantisBT through 1.3.14, and 2.0.0
Affected: through 1.3.14; 2.0.0
CVE-2014-9701
6.5
2%
Aug 9
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url…
Affected: through 1.2.18; 1.3.0
CVE-2017-7620
6.5
1%
May 21
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/…
Affected: through 1.3.10; 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +5 more
CVE-2026-33548
6.1
0%
Mar 23
MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline
Affected: = 2.28.0
CVE-2026-33517
6.1
0%
Mar 23
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
Affected: = 2.28.0
CVE-2022-28508
6.1
5%
May 4
An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2
Affected: before 2.25.2
CVE-2022-26144
6.1
1%
Apr 13
An XSS issue was discovered in MantisBT before 2.25.3
Affected: before 2.25.3
CVE-2021-33557
6.1
2%
Jun 17
An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2
Affected: before 2.25.2
CVE-2020-35571
6.1
1%
Feb 22
An issue was discovered in MantisBT through 2.24.3
Affected: through 2.24.3
CVE-2019-15539
6.1
1%
Mar 19
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if…
Affected: before 2.21.3
CVE-2009-2802
6.1
1%
Nov 9
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types
Affected: 1.2.0 before 1.2.2
CVE-2013-1931
6.1
2%
Oct 31
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version
Affected: 1.2.14
CVE-2018-13055
6.1
2%
Aug 3
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if…
Affected: 2.1.0 through 2.15.0
CVE-2018-14504
6.1
2%
Aug 3
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0
Affected: 2.0.0 through 2.15.0
CVE-2015-2046
6.1
2%
Aug 28
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20
Affected: 1.2.13; 1.2.14; 1.2.15; 1.2.16; 1.2.17; 1.2.18; +1 more
CVE-2017-12062
6.1
4%
Aug 1
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2
Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1; +12 more
CVE-2017-12061
6.1
3%
Aug 1
An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2
Affected: 1.3.0 before 1.3.12; 2.0.0 before 2.5.2
CVE-2017-7897
6.1
2%
Apr 18
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php)…
Affected: 2.3.0; 2.3.1
CVE-2017-7222
6.1
1%
Mar 22
A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by…
Affected: through 2.1.0
CVE-2017-6799
6.1
4%
Mar 10
A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter
Affected: through 2.2.0
CVE-2017-6797
6.1
2%
Mar 10
A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via…
Affected: before 1.3.7; 2.0.0 before 2.2.1
CVE-2016-5364
6.1
2%
Feb 17
Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the…
Affected: through 1.2.19
CVE-2016-6837
6.1
4%
Jan 10
Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject…
Affected: through 1.2.18; 1.3.0; 2.0.0
CVE-2026-39960
5.4
0%
May 20
MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values
Affected: < 2.28.2
CVE-2025-55155
5.4
0%
Nov 4
MantisBT: Authentication bypass for some passwords due to PHP type juggling
Affected: < 2.27.2
CVE-2022-33910
5.4
1%
Jun 24
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes
Affected: before 2.25.5
Page 1 of 3 · 140 total
123