Skip to content

Vendor

mantisbt vulnerabilities

152 published CVES affecting mantisbt, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
152
Critical
5
High
31
Medium
104
Low
12
Unscored
0
CISA KEV
0
Atom feed of mantisbt alerts

Products

Latest mantisbt CVEs

Newest publication first · page 1 of 7

  2. CVE-2026-62944 MantisBT: Stored XSS in print_all_bug_page_word.php

    Published
    HighCVSS 8.6

    A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1). When any user views the HTML export page (print_a...

  6. CVE-2026-52847 MantisBT: Reflected XSS in admin/install.php

    Published
    CriticalCVSS 9.2

    MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required. A Content Security Policy (script-src 'self') prevents inline Java...

  7. CVE-2026-49280 MantisBT: REST API unauthorized Issue status change

    Published
    MediumCVSS 5.3

    A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default). Impact Unauthorized change in Issue workflow. Patches https://github...

  9. CVE-2026-47142 MantisBT: SQL Injection via history_order Configuration Value

    Published
    HighCVSS 8.5

    MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist. An adminis...

  10. CVE-2026-42071 MantisBT: Private Bugnote Attachment Content Leak via REST API

    Published
    HighCVSS 7.2 EPSS 0.26%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via...

  12. CVE-2026-44655 MantisBT: Stored XSS on Move Attachments Admin Page

    Published
    HighCVSS 8.6 EPSS 0.30%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. This vulnerability is fix...

  13. CVE-2026-41897 MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field

    Published
    MediumCVSS 5.3 EPSS 0.28%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA...

  14. CVE-2026-44657 MantisBT: Stored XSS in File Download

    Published
    HighCVSS 7.5 EPSS 0.35%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachme...

  17. CVE-2026-40597 MantisBT has a Content Security Policy bypass via attachments

    Published
    HighCVSS 7.6 EPSS 0.50%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, w...

  23. CVE-2026-34579 MantisBT has an authorization bypass via private issue monitoring

    Published
    MediumCVSS 5.3 EPSS 0.36%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves...

  24. CVE-2026-34463 MantisBT has Stored HTML Injection/XSS via Clone Issue Form

    Published
    HighCVSS 8.6 EPSS 0.44%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before t...

  25. CVE-2026-34390 MantisBT: Privilege Escalation from Manager to Administrator

    Published
    MediumCVSS 5.1 EPSS 0.43%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand (manage_proj_user_add.php) allow users having manage_project_threshold access leve...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.