Mmantisbt

Products

Exploited and recent CVEs

• CVE-2026-47156 Critical 9.3 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator 0.7%
• CVE-2026-42071 High 7.2 MantisBT: Private Bugnote Attachment Content Leak via REST API 0.3%
• CVE-2026-42070 Medium 5.3 MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API 0.3%
• CVE-2026-44655 High 8.6 MantisBT: Stored XSS on Move Attachments Admin Page 0.3%
• CVE-2026-41897 Medium 5.3 MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field 0.3%
• CVE-2026-44657 High 7.5 MantisBT: Stored XSS in File Download 0.3%
• CVE-2026-40607 High 7.5 MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column 0.4%
• CVE-2026-40598 Medium 6.9 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page 0.4%
• CVE-2026-40597 High 7.6 MantisBT has a Content Security Policy bypass via attachments 0.5%
• CVE-2026-40596 High 7.2 MantisBT is vulnerable to XSS and potential account takeover via user font family preference update 0.4%
• CVE-2026-39960 Medium 5.4 MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values 0.2%
• CVE-2026-34970 Medium 5.3 MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked 0.4%
• CVE-2026-34754 Medium 4.3 MantisBT allows unauthorized users to upload attachments to restricted issues via REST API 0.2%
• CVE-2026-34744 Medium 5.3 MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues 0.4%
• CVE-2026-34579 Medium 5.3 MantisBT has an authorization bypass via private issue monitoring 0.4%
• CVE-2026-34463 High 8.6 MantisBT has Stored HTML Injection/XSS via Clone Issue Form 0.4%
• CVE-2026-34390 Medium 5.1 MantisBT: Privilege Escalation from Manager to Administrator 0.4%
• CVE-2026-33052 Medium 5.3 MantisBT: Authorization Bypass in Global Profile Creation 0.3%
• CVE-2026-33548 High 8.6 MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline 0.2%
• CVE-2026-33517 High 8.6 MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation 0.2%
• CVE-2026-30849 Critical 9.3 MantisBT SOAP API has an authentication bypass vulnerability on MySQL 1.8%
• CVE-2025-62520 Medium 5.3 MantisBT unauthorized disclosure of private project column configuration 0.3%
• CVE-2025-55155 Medium 5.4 MantisBT: Authentication bypass for some passwords due to PHP type juggling 0.2%
• CVE-2025-47776 High 8.8 MantisBT: Authentication bypass for some passwords due to PHP type juggling 0.3%
• CVE-2025-46556 Medium 6.5 MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length 0.4%
• CVE-2024-45792 Medium 5.3 MantisBT vulnerable to information disclosure with user profiles 0.5%
• CVE-2024-34081 Medium 6.6 MantisBT Cross-site Scripting vulnerability 0.6%
• CVE-2024-34080 Medium 5.3 MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor 0.7%
• CVE-2024-34077 High 7.3 MantisBT user account takeover in the signup/reset password process 1.2%
• CVE-2024-23830 High 8.3 MantisBT Host Header Injection vulnerability 1.0%