Mantisbt/mantisbt
This hub aggregates every CVE we track for Mantisbt/mantisbt, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
45
CVEs tracked
2
Critical
7
High
0
In CISA KEV
Severity distribution
MEDIUM35HIGH7CRITICAL2LOW1
Monthly trend
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
4
0
0
0
0
0
0
0
2024-072026-06
Latest CVEs
The 15 most recently published vulnerabilities affecting Mantisbt/mantisbt.
- CVE-2025-62520MantisBT unauthorized disclosure of private project column configuration4.3
- CVE-2025-55155MantisBT: Authentication bypass for some passwords due to PHP type juggling5.4
- CVE-2025-47776MantisBT: Authentication bypass for some passwords due to PHP type juggling9.1
- CVE-2025-46556MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length6.5
- CVE-2024-45792MantisBT vulnerable to information disclosure with user profiles6.5
- CVE-2024-34081MantisBT Cross-site Scripting vulnerability6.6
- CVE-2024-34080MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor5.3
- CVE-2024-34077MantisBT user account takeover in the signup/reset password process7.3
- CVE-2024-23830MantisBT Host Header Injection vulnerability8.3
- CVE-2023-44394Disclosure of project names to unauthorized users in MantisBT4.3
- CVE-2023-22476MantisBT: Exposure of Private issues' summary to unauthorized users4.3
- CVE-2022-33910An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download....5.4
- CVE-2022-28508An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.6.1
- CVE-2021-43257Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.ph...7.8
- CVE-2022-26144An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall...6.1
Product normalization is registry-driven with AI assist and human review. How it works