Skip to content
OpenAdvisories

Package · Packagist

mantisbt/mantisbt

74 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-47156

    MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

    MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), in…

    mantisbt mantisbt mantisbt/mantisbt Packagist
  • Critical —
    CVE-2026-52881

    MantisBT: Reflected XSS in admin/install.php via unescaped printf

    MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required. A Content Security Policy (sc…

    mantisbt/mantisbt Packagist
  • Critical —
    CVE-2026-52847

    MantisBT: Reflected XSS in admin/install.php

    MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required. A Content Security Policy (script-src 'self…

    mantisbt/mantisbt Packagist
  • Critical 9.3
    CVE-2026-30849 Public exploit Scanner template

    MantisBT SOAP API has an authentication bypass vulnerability on MySQL

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password paramete…

    mantisbt mantisbt mantisbt/mantisbt Packagist