Mantisbt vulnerabilities
36 CVEs and advisories name Mantisbt as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47156MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-42071MantisBT: Private Bugnote Attachment Content Leak via REST API
- CVE-2026-42070MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
- CVE-2026-44655MantisBT: Stored XSS on Move Attachments Admin Page
- CVE-2026-41897MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field
- CVE-2026-44657MantisBT: Stored XSS in File Download
- CVE-2026-40607MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column
- CVE-2026-40598MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
- CVE-2026-40597MantisBT has a Content Security Policy bypass via attachments
- CVE-2026-40596MantisBT is vulnerable to XSS and potential account takeover via user font family preference update
- CVE-2026-39960MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values
- CVE-2026-34970MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
- CVE-2026-34754MantisBT allows unauthorized users to upload attachments to restricted issues via REST API
- CVE-2026-34744MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues
- CVE-2026-34579MantisBT has an authorization bypass via private issue monitoring
- CVE-2026-34463MantisBT has Stored HTML Injection/XSS via Clone Issue Form
- CVE-2026-34390MantisBT: Privilege Escalation from Manager to Administrator
- CVE-2026-33052MantisBT: Authorization Bypass in Global Profile Creation
- CVE-2026-33548MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline
- CVE-2026-33517MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
- CVE-2026-30849MantisBT SOAP API has an authentication bypass vulnerability on MySQL
- CVE-2025-62520MantisBT unauthorized disclosure of private project column configuration
- CVE-2025-55155MantisBT: Authentication bypass for some passwords due to PHP type juggling
- CVE-2025-47776MantisBT: Authentication bypass for some passwords due to PHP type juggling
- CVE-2025-46556MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length
- CVE-2024-45792MantisBT vulnerable to information disclosure with user profiles
- CVE-2024-34081MantisBT Cross-site Scripting vulnerability
- CVE-2024-34080MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-34077MantisBT user account takeover in the signup/reset password process
- CVE-2024-23830MantisBT Host Header Injection vulnerability