# cve.now: Mantisbt The newest entries naming Mantisbt as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-47156](https://cve.now/CVE-2026-47156.md): MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator (CVSS 9.3) - [CVE-2026-42071](https://cve.now/CVE-2026-42071.md): MantisBT: Private Bugnote Attachment Content Leak via REST API (CVSS 7.2) - [CVE-2026-42070](https://cve.now/CVE-2026-42070.md): MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API (CVSS 5.3) - [CVE-2026-44655](https://cve.now/CVE-2026-44655.md): MantisBT: Stored XSS on Move Attachments Admin Page (CVSS 8.6) - [CVE-2026-41897](https://cve.now/CVE-2026-41897.md): MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field (CVSS 5.3) - [CVE-2026-44657](https://cve.now/CVE-2026-44657.md): MantisBT: Stored XSS in File Download (CVSS 7.5) - [CVE-2026-40607](https://cve.now/CVE-2026-40607.md): MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column (CVSS 7.5) - [CVE-2026-40598](https://cve.now/CVE-2026-40598.md): MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page (CVSS 6.9) - [CVE-2026-40597](https://cve.now/CVE-2026-40597.md): MantisBT has a Content Security Policy bypass via attachments (CVSS 7.6) - [CVE-2026-40596](https://cve.now/CVE-2026-40596.md): MantisBT is vulnerable to XSS and potential account takeover via user font family preference update (CVSS 7.2) - [CVE-2026-39960](https://cve.now/CVE-2026-39960.md): MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values (CVSS 5.4) - [CVE-2026-34970](https://cve.now/CVE-2026-34970.md): MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked (CVSS 5.3) - [CVE-2026-34754](https://cve.now/CVE-2026-34754.md): MantisBT allows unauthorized users to upload attachments to restricted issues via REST API (CVSS 4.3) - [CVE-2026-34744](https://cve.now/CVE-2026-34744.md): MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues (CVSS 5.3) - [CVE-2026-34579](https://cve.now/CVE-2026-34579.md): MantisBT has an authorization bypass via private issue monitoring (CVSS 5.3) - [CVE-2026-34463](https://cve.now/CVE-2026-34463.md): MantisBT has Stored HTML Injection/XSS via Clone Issue Form (CVSS 8.6) - [CVE-2026-34390](https://cve.now/CVE-2026-34390.md): MantisBT: Privilege Escalation from Manager to Administrator (CVSS 5.1) - [CVE-2026-33052](https://cve.now/CVE-2026-33052.md): MantisBT: Authorization Bypass in Global Profile Creation (CVSS 5.3) - [CVE-2026-33548](https://cve.now/CVE-2026-33548.md): MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline (CVSS 8.6) - [CVE-2026-33517](https://cve.now/CVE-2026-33517.md): MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation (CVSS 8.6) - [CVE-2026-30849](https://cve.now/CVE-2026-30849.md): MantisBT SOAP API has an authentication bypass vulnerability on MySQL (CVSS 9.3) - [CVE-2025-62520](https://cve.now/CVE-2025-62520.md): MantisBT unauthorized disclosure of private project column configuration (CVSS 5.3) - [CVE-2025-55155](https://cve.now/CVE-2025-55155.md): MantisBT: Authentication bypass for some passwords due to PHP type juggling (CVSS 5.4) - [CVE-2025-47776](https://cve.now/CVE-2025-47776.md): MantisBT: Authentication bypass for some passwords due to PHP type juggling (CVSS 8.8) - [CVE-2025-46556](https://cve.now/CVE-2025-46556.md): MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length (CVSS 6.5) - [CVE-2024-45792](https://cve.now/CVE-2024-45792.md): MantisBT vulnerable to information disclosure with user profiles (CVSS 5.3) - [CVE-2024-34081](https://cve.now/CVE-2024-34081.md): MantisBT Cross-site Scripting vulnerability (CVSS 6.6) - [CVE-2024-34080](https://cve.now/CVE-2024-34080.md): MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3) - [CVE-2024-34077](https://cve.now/CVE-2024-34077.md): MantisBT user account takeover in the signup/reset password process (CVSS 7.3) - [CVE-2024-23830](https://cve.now/CVE-2024-23830.md): MantisBT Host Header Injection vulnerability (CVSS 8.3) - [CVE-2023-44394](https://cve.now/CVE-2023-44394.md): Disclosure of project names to unauthorized users in MantisBT (CVSS 4.3) - [CVE-2023-22476](https://cve.now/CVE-2023-22476.md): MantisBT: Exposure of Private issues' summary to unauthorized users (CVSS 4.3) - [CVE-2013-1934](https://cve.now/CVE-2013-1934.md): A cross-site scripting (XSS) vulnerability in the configuration report page (adm\_config\_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allow (no CVSS) - [CVE-2013-1932](https://cve.now/CVE-2013-1932.md): A cross-site scripting (XSS) vulnerability in the configuration report page (adm\_config\_report.php) in MantisBT 1.2.13 allows remote authent (no CVSS) - [CVE-2013-1931](https://cve.now/CVE-2013-1931.md): A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, (no CVSS) - [CVE-2013-1930](https://cve.now/CVE-2013-1930.md): MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/mantisbt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.