CVE Tools
Track your stack

Mantisbt/mantisbt

45 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Mantisbt/mantisbt, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Mantisbt/mantisbt CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Mantisbt/mantisbt CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-114
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 45 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical24%
  • High716%
  • Medium3578%
  • Low12%

Latest CVEs

The 15 most recently published vulnerabilities affecting Mantisbt/mantisbt.

  1. CVE-2025-62520MantisBT unauthorized disclosure of private project column configuration4.3
  2. CVE-2025-55155MantisBT: Authentication bypass for some passwords due to PHP type juggling5.4
  3. CVE-2025-47776MantisBT: Authentication bypass for some passwords due to PHP type juggling9.1
  4. CVE-2025-46556MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length6.5
  5. CVE-2024-45792MantisBT vulnerable to information disclosure with user profiles6.5
  6. CVE-2024-34081MantisBT Cross-site Scripting vulnerability6.6
  7. CVE-2024-34080MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor5.3
  8. CVE-2024-34077MantisBT user account takeover in the signup/reset password process7.3
  9. CVE-2024-23830MantisBT Host Header Injection vulnerability8.3
  10. CVE-2023-44394Disclosure of project names to unauthorized users in MantisBT4.3
  11. CVE-2023-22476MantisBT: Exposure of Private issues' summary to unauthorized users4.3
  12. CVE-2022-33910An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download....5.4
  13. CVE-2022-28508An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.6.1
  14. CVE-2021-43257Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.ph...7.8
  15. CVE-2022-26144An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall...6.1

Product grouping is registry-driven, with AI assist and human review. How it works