MA
Product
mantisbt
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 16Medium 65Low 1
Watch
Add mantisbt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40598 | 6.9 | May 22 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page Affected: < 2.28.2 |
| CVE-2024-45792 | 6.5 | Sep 30 | MantisBT vulnerable to information disclosure with user profiles Affected: < 2.26.4 |
| CVE-2020-29604 | 6.5 | Jan 29 | An issue was discovered in MantisBT before 2.24.4 Affected: before 2.24.4 |
| CVE-2020-28413 | 6.5 | Dec 30 | In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP Affected: 2.24.3 |
| CVE-2018-9839 | 6.5 | Jun 6 | An issue was discovered in MantisBT through 1.3.14, and 2.0.0 Affected: through 1.3.14; 2.0.0 |
| CVE-2014-9701 | 6.5 | Aug 9 | Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url… Affected: through 1.2.18; 1.3.0 |
| CVE-2017-7620 | 6.5 | May 21 | MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/… Affected: through 1.3.10; 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +5 more |
| CVE-2026-33548 | 6.1 | Mar 23 | MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline Affected: = 2.28.0 |
| CVE-2026-33517 | 6.1 | Mar 23 | MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation Affected: = 2.28.0 |
| CVE-2022-28508 | 6.1 | May 4 | An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2 Affected: before 2.25.2 |
| CVE-2022-26144 | 6.1 | Apr 13 | An XSS issue was discovered in MantisBT before 2.25.3 Affected: before 2.25.3 |
| CVE-2021-33557 | 6.1 | Jun 17 | An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2 Affected: before 2.25.2 |
| CVE-2020-35571 | 6.1 | Feb 22 | An issue was discovered in MantisBT through 2.24.3 Affected: through 2.24.3 |
| CVE-2019-15539 | 6.1 | Mar 19 | The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if… Affected: before 2.21.3 |
| CVE-2009-2802 | 6.1 | Nov 9 | MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types Affected: 1.2.0 before 1.2.2 |
| CVE-2013-1931 | 6.1 | Oct 31 | A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version Affected: 1.2.14 |
| CVE-2018-13055 | 6.1 | Aug 3 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if… Affected: 2.1.0 through 2.15.0 |
| CVE-2018-14504 | 6.1 | Aug 3 | An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0 Affected: 2.0.0 through 2.15.0 |
| CVE-2015-2046 | 6.1 | Aug 28 | Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20 Affected: 1.2.13; 1.2.14; 1.2.15; 1.2.16; 1.2.17; 1.2.18; +1 more |
| CVE-2017-12062 | 6.1 | Aug 1 | An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2 Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1; +12 more |
| CVE-2017-12061 | 6.1 | Aug 1 | An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2 Affected: 1.3.0 before 1.3.12; 2.0.0 before 2.5.2 |
| CVE-2017-7897 | 6.1 | Apr 18 | A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php)… Affected: 2.3.0; 2.3.1 |
| CVE-2017-7222 | 6.1 | Mar 22 | A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by… Affected: through 2.1.0 |
| CVE-2017-6799 | 6.1 | Mar 10 | A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter Affected: through 2.2.0 |
| CVE-2017-6797 | 6.1 | Mar 10 | A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via… Affected: before 1.3.7; 2.0.0 before 2.2.1 |
| CVE-2016-5364 | 6.1 | Feb 17 | Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the… Affected: through 1.2.19 |
| CVE-2016-6837 | 6.1 | Jan 10 | Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject… Affected: through 1.2.18; 1.3.0; 2.0.0 |
| CVE-2026-39960 | 5.4 | May 20 | MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values Affected: < 2.28.2 |
| CVE-2025-55155 | 5.4 | Nov 4 | MantisBT: Authentication bypass for some passwords due to PHP type juggling Affected: < 2.27.2 |
| CVE-2022-33910 | 5.4 | Jun 24 | An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes Affected: before 2.25.5 |
| CVE-2020-16266 | 5.4 | Aug 12 | An XSS issue was discovered in MantisBT before 2.24.2 Affected: before 2.24.2 |
| CVE-2013-1934 | 5.4 | Oct 31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject… Affected: 1.2.1 through 1.2.14; 1.2.0; 1.2.0; 1.2.0 |
| CVE-2013-1932 | 5.4 | Oct 31 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web… Affected: 1.2.13 |
| CVE-2018-17783 | 5.4 | Oct 30 | A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit… Affected: 2.1.0 through 2.17.1 |
| CVE-2018-17782 | 5.4 | Oct 30 | A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit… Affected: 2.1.0 through 2.17.1 |
| CVE-2014-9271 | 5.4 | Jan 9 | Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file… Affected: 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; 1.1.0; +33 more |
| CVE-2026-42070 | 5.3 | May 28 | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API Affected: < 2.28.2 |
| CVE-2026-41897 | 5.3 | May 28 | MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field Affected: >= 1.0.0, < 2.28.2 |
| CVE-2026-34970 | 5.3 | May 19 | MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked Affected: < 2.28.2 |
| CVE-2026-34744 | 5.3 | May 19 | MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues Affected: < 2.28.2 |
| CVE-2026-34579 | 5.3 | May 19 | MantisBT has an authorization bypass via private issue monitoring Affected: < 2.28.2 |
| CVE-2026-33052 | 5.3 | May 19 | MantisBT: Authorization Bypass in Global Profile Creation Affected: >= 2.28.0, < 2.28.2 |
| CVE-2024-34080 | 5.3 | May 13 | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Affected: < 2.26.2 |
| CVE-2018-6526 | 5.3 | Feb 2 | view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a… Affected: through 2.10.0 |
| CVE-2015-5059 | 5.3 | Aug 1 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated… Affected: through 1.2.19 |
| CVE-2014-9759 | 5.3 | Apr 11 | Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt… Affected: 1.3.0 |
| CVE-2026-34390 | 5.1 | May 19 | MantisBT: Privilege Escalation from Manager to Administrator Affected: < 2.28.2 |
| CVE-2017-12419 | 4.9 | Aug 5 | If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and… Affected: 2.5.2 |
| CVE-2024-34081 | 4.8 | May 13 | MantisBT Cross-site Scripting vulnerability Affected: < 2.26.2 |
| CVE-2020-25830 | 4.8 | Sep 30 | An issue was discovered in MantisBT before 2.24.3 Affected: before 2.24.3 |