MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php

MantisBT: Stored XSS on Move Attachments Admin Page

MantisBT has Stored HTML Injection/XSS via Clone Issue Form

MantisBT Host Header Injection vulnerability

An issue was discovered in MantisBT before 2.24.5

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens…

MantisBT has a Content Security Policy bypass via attachments

MantisBT: Stored XSS in File Download

MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column

MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length

An issue was discovered in MantisBT before 2.24.4

CAPTCHA bypass vulnerability in MantisBT before 1.2.19

MantisBT user account takeover in the signup/reset password process

MantisBT: Private Bugnote Attachment Content Leak via REST API

MantisBT is vulnerable to XSS and potential account takeover via user font family preference update

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution