MA
Product
mantisbt
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 16Medium 65Low 1
Watch
Add mantisbt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-16266 | 5.4 | Aug 12 | An XSS issue was discovered in MantisBT before 2.24.2 Affected: before 2.24.2 |
| CVE-2013-1934 | 5.4 | Oct 31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject… Affected: 1.2.1 through 1.2.14; 1.2.0; 1.2.0; 1.2.0 |
| CVE-2013-1932 | 5.4 | Oct 31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web… Affected: 1.2.13 |
| CVE-2018-17783 | 5.4 | Oct 30 | A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit… Affected: 2.1.0 through 2.17.1 |
| CVE-2018-17782 | 5.4 | Oct 30 | A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit… Affected: 2.1.0 through 2.17.1 |
| CVE-2014-9271 | 5.4 | Jan 9 | Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file… Affected: 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +33 more |
| CVE-2026-42070 | 5.3 | May 28 | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API Affected: < 2.28.2 |
| CVE-2026-41897 | 5.3 | May 28 | MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field Affected: >= 1.0.0, < 2.28.2 |
| CVE-2026-34970 | 5.3 | May 19 | MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked Affected: < 2.28.2 |
| CVE-2026-34744 | 5.3 | May 19 | MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues Affected: < 2.28.2 |
| CVE-2026-34579 | 5.3 | May 19 | MantisBT has an authorization bypass via private issue monitoring Affected: < 2.28.2 |
| CVE-2026-33052 | 5.3 | May 19 | MantisBT: Authorization Bypass in Global Profile Creation Affected: >= 2.28.0, < 2.28.2 |
| CVE-2024-34080 | 5.3 | May 13 | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Affected: < 2.26.2 |
| CVE-2018-6526 | 5.3 | Feb 2 | view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a… Affected: through 2.10.0 |
| CVE-2015-5059 | 5.3 | Aug 1 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated… Affected: through 1.2.19 |
| CVE-2014-9759 | 5.3 | Apr 11 | Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt… Affected: 1.3.0 |
| CVE-2026-34390 | 5.1 | May 19 | MantisBT: Privilege Escalation from Manager to Administrator Affected: < 2.28.2 |
| CVE-2017-12419 | 4.9 | Aug 5 | If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and… Affected: 2.5.2 |
| CVE-2024-34081 | 4.8 | May 13 | MantisBT Cross-site Scripting vulnerability Affected: < 2.26.2 |
| CVE-2020-25830 | 4.8 | Sep 30 | An issue was discovered in MantisBT before 2.24.3 Affected: before 2.24.3 |
| CVE-2020-25288 | 4.8 | Sep 30 | An issue was discovered in MantisBT before 2.24.3 Affected: before 2.24.3 |
| CVE-2017-7309 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +18 more |
| CVE-2017-7241 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code… Affected: 1.2.16; 1.2.17; 1.2.18; 1.2.19; 1.2.20; 1.3.0; +29 more |
| CVE-2017-6973 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +17 more |
| CVE-2018-16514 | 4.7 | Jun 20 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0… Affected: 2.1.0 through 2.17.0 |
| CVE-2016-7111 | 4.7 | Feb 17 | MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting… Affected: through 1.3.0; 2.0.0 |
| CVE-2026-34754 | 4.3 | May 19 | MantisBT allows unauthorized users to upload attachments to restricted issues via REST API Affected: < 2.28.2 |
| CVE-2025-62520 | 4.3 | Nov 4 | MantisBT unauthorized disclosure of private project column configuration Affected: < 2.27.2 |
| CVE-2023-44394 | 4.3 | Oct 16 | MantisBT is an open source bug tracker Affected: before 2.25.8 |
| CVE-2023-22476 | 4.3 | Feb 23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker Affected: before 2.25.6 |
| CVE-2020-29605 | 4.3 | Jan 29 | An issue was discovered in MantisBT before 2.24.4 Affected: before 2.24.4 |
| CVE-2020-29603 | 4.3 | Jan 29 | In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id… Affected: before 2.24.4 |
| CVE-2020-25781 | 4.3 | Sep 30 | An issue was discovered in file_download.php in MantisBT before 2.24.3 Affected: before 2.24.3 |
| CVE-2013-1811 | 4.3 | Nov 7 | An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New" Affected: before 1.2.13 |
| CVE-2013-1930 | 4.3 | Oct 31 | MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues Affected: 1.2.12 before 1.2.15 |
| CVE-2018-6382 | 3.3 | Jan 30 | MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address Affected: 2.10.0 |
| CVE-2014-8987 | – | Aug 24 | Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote… Affected: 1.2.13; 1.2.14; 1.2.15; 1.2.16; 1.2.17 |
| CVE-2015-1042 | – | Feb 10 | The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open… Affected: 1.2.0; 1.2.0; 1.2.0; 1.2.1; 1.2.2; 1.2.3; +15 more |
| CVE-2014-9573 | – | Jan 26 | SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary… Affected: through 1.2.18; 1.3.0 |
| CVE-2014-9572 | – | Jan 26 | MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the… Affected: through 1.2.18; 1.3.0 |
| CVE-2014-9571 | – | Jan 26 | Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or… Affected: through 1.2.18; 1.3.0 |
| CVE-2014-9272 | – | Jan 9 | The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site… Affected: 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +33 more |
| CVE-2014-9269 | – | Jan 9 | Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to… Affected: 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +34 more |
| CVE-2014-9506 | – | Jan 4 | MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote… Affected: through 1.2.17 |
| CVE-2014-9388 | – | Dec 17 | bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter Affected: through 1.2.17 |
| CVE-2014-8553 | – | Dec 17 | The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1)… Affected: through 1.2.17 |
| CVE-2014-6316 | – | Dec 12 | core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and… Affected: through 1.2.17 |
| CVE-2014-9281 | – | Dec 9 | Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field Affected: through 1.2.17 |
| CVE-2014-9280 | – | Dec 8 | The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter Affected: through 1.2.17 |
| CVE-2014-9279 | – | Dec 8 | The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |