MA
Product
mantisbt
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 16Medium 65Low 1
Watch
Add mantisbt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-25288 | 4.8 | Sep 30 | An issue was discovered in MantisBT before 2.24.3 Affected: before 2.24.3 |
| CVE-2017-7309 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +18 more |
| CVE-2017-7241 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code… Affected: 1.2.16; 1.2.17; 1.2.18; 1.2.19; 1.2.20; 1.3.0; +29 more |
| CVE-2017-6973 | 4.8 | Mar 31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +17 more |
| CVE-2018-16514 | 4.7 | Jun 20 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0… Affected: 2.1.0 through 2.17.0 |
| CVE-2016-7111 | 4.7 | Feb 17 | MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting… Affected: through 1.3.0; 2.0.0 |
| CVE-2026-34754 | 4.3 | May 19 | MantisBT allows unauthorized users to upload attachments to restricted issues via REST API Affected: < 2.28.2 |
| CVE-2025-62520 | 4.3 | Nov 4 | MantisBT unauthorized disclosure of private project column configuration Affected: < 2.27.2 |
| CVE-2023-44394 | 4.3 | Oct 16 | Disclosure of project names to unauthorized users in MantisBT Affected: < 2.25.8 |
| CVE-2023-22476 | 4.3 | Feb 23 | MantisBT: Exposure of Private issues' summary to unauthorized users Affected: < 2.25.6 |
| CVE-2020-29605 | 4.3 | Jan 29 | An issue was discovered in MantisBT before 2.24.4 Affected: before 2.24.4 |
| CVE-2020-29603 | 4.3 | Jan 29 | In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id… Affected: before 2.24.4 |
| CVE-2020-25781 | 4.3 | Sep 30 | An issue was discovered in file_download.php in MantisBT before 2.24.3 Affected: before 2.24.3 |
| CVE-2013-1811 | 4.3 | Nov 7 | An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New" Affected: before 1.2.13 |
| CVE-2013-1930 | 4.3 | Oct 31 | MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues Affected: 1.2.12 before 1.2.15 |