Skip to content
OpenAdvisories

Package · Packagist

mantisbt/mantisbt

74 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-30849 Public exploit Scanner template

    MantisBT SOAP API has an authentication bypass vulnerability on MySQL

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password paramete…

    mantisbt mantisbt mantisbt/mantisbt Packagist
  • Medium 6.1
    CVE-2022-28508 Public exploit Scanner template

    MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php

    An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

    mantisbt/mantisbt Packagist
  • Medium 5.3
    CVE-2020-28413 Public exploit

    MantisBT SQL Injection via mc_project_get_users function

    In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.

    mantisbt/mantisbt Packagist
  • High 7.2
    CVE-2019-15715 Public exploit EPSS 30%

    MantisBT Remote Code Execution

    MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

    mantisbt/mantisbt Packagist
  • Medium 6.5
    CVE-2017-7620 Public exploit

    MantisBT vulnerable to CSRF and Open Redirect attacks

    MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

    mantisbt/mantisbt Packagist
  • High 8.8
    CVE-2017-7615 Public exploit Scanner template EPSS 91%

    MantisBT allows arbitrary password reset

    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

    mantisbt/mantisbt Packagist