Search for packages
| purl | pkg:composer/mantisbt/mantisbt@2.13.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-q747-c74m-69pr
Aliases: CVE-2025-55155 |
MantisBT lacks verification when changing a user's email address When a user edits their profile to change their e-mail address, … |
Vulnerable |
|
GHSA-g582-8vwr-68h2
Aliases: CVE-2025-62520 |
MantisBT unauthorized disclosure of private project column configuration ### Impact Due to insufficient access-level checks, any non-admin user having access … |
Vulnerable |
|
GHSA-4v8w-gg5j-ph37
Aliases: CVE-2025-47776 |
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling Due to an incorrect use of loose … |
Vulnerable |
|
GHSA-r3jf-hm7q-qfw5
Aliases: CVE-2025-46556 |
MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length A lack of server-side validation for note length in MantisBT allows … |
Vulnerable |
|
GHSA-jm72-67rm-763j
Aliases: CVE-2009-20001 |
MantisBT Insufficient Session Expiration cookie string not reset after logout An issue was discovered in MantisBT before 2.24.5. It associates … |
Vulnerable |
|
GHSA-rg8f-5p7x-m6wv
Aliases: CVE-2021-43257 |
MantisBT CSV Injection unprivileged user access in csv_export.php Lack of Neutralization of Formula Elements in the CSV API of MantisBT … |
Vulnerable |
|
GHSA-rqgj-rqfr-5j6f
Aliases: CVE-2022-26144 |
MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php An XSS issue was discovered in MantisBT before … |
Vulnerable |
|
GHSA-qghg-v7xv-q98q
Aliases: CVE-2022-33910 |
MantisBT XSS through crafted SVG documents in file_download.php An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach … |
Vulnerable |
|
GHSA-52cx-vphc-jmjm
Aliases: CVE-2021-33557 |
MantisBT allows XSS in manage_custom_field_edit_page.php An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the … |
Vulnerable |
|
GHSA-v23g-wjvq-2fpf
Aliases: CVE-2019-15715 |
MantisBT Remote Code Execution MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. |
Vulnerable |
|
GHSA-qpj5-f88q-x7px
Aliases: CVE-2020-29603 |
MantisBT Insecure Storage in manage_proj_edit_page.php In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names … |
Vulnerable |
|
GHSA-cvrm-cr3m-qj92
Aliases: CVE-2020-35571 |
MantisBT XSS in manage_custom_field_update.php An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom … |
Vulnerable |
|
GHSA-2pm7-q8pc-xhvq
Aliases: CVE-2020-25830 |
MantisBT HTML Injection vulnerability An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows … |
Vulnerable |
|
GHSA-pgg9-mmcg-8mxp
Aliases: CVE-2020-29605 |
MantisBT Incorrect Authorization in bug_actiongroup_page.php An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in … |
Vulnerable |
|
GHSA-xjmx-cprh-646r
Aliases: CVE-2020-25781 |
MantisBT unauthorized users able to access private files An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without … |
Vulnerable |
|
GHSA-49w9-82cj-xr48
Aliases: CVE-2020-28413 |
MantisBT SQL Injection via mc_project_get_users function In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users … |
Vulnerable |
|
GHSA-7j8m-fm49-xgmg
Aliases: CVE-2020-35849 |
MantisBT Incorrect Authorization for bug_revision_view_page.php check An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php … |
Vulnerable |
|
GHSA-wfg2-2wmw-6894
Aliases: CVE-2022-28508 |
MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php An XSS issue was discovered in browser_search_plugin.php in MantisBT up to … | There are no reported fixed by versions. |
|
GHSA-p495-jrpq-p66g
Aliases: CVE-2019-15539 |
MantisBT XSS when uploading an attachment The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting … |
Vulnerable |
|
GHSA-gg4j-279j-22ph
Aliases: CVE-2019-15074 |
MantisBT allows cross-site scripting (XSS) via crafted filename The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored … |
Vulnerable |
|
GHSA-f38c-wxp6-8xjv
Aliases: CVE-2020-29604 |
MantisBT Missing Authorization access check in bug_actiongroup.php An issue was discovered in MantisBT before 2.24.4. A missing access check in … |
Vulnerable |
|
GHSA-mcqj-7p29-9528
Aliases: CVE-2024-23830 |
MantisBT Host Header Injection vulnerability ### Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the … |
Vulnerable |
|
GHSA-99jc-wqmr-ff2q
Aliases: CVE-2024-34080 |
MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor If an issue references a note that belongs to … |
Vulnerable |
|
GHSA-wgx7-jp56-65mq
Aliases: CVE-2024-34081 |
Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting Improper escaping of a custom field's name allows an attacker to inject … |
Vulnerable |
|
GHSA-93x3-m7pw-ppqm
Aliases: CVE-2024-34077 |
Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process Insufficient access control in the registration and … |
Vulnerable |
|
GHSA-h5q3-fjp4-2x7r
Aliases: CVE-2024-45792 |
MantisBT vulnerable to information disclosure with user profiles Using a crafted POST request, an unprivileged, registered user is able to … |
Vulnerable |
|
GHSA-v642-mh27-8j6m
Aliases: CVE-2023-44394 |
MantisBT may disclose project names to unauthorized users ### Impact Due to insufficient access-level checks on the Wiki redirection page, … |
Vulnerable |
|
GHSA-hf4x-6h87-hm79
Aliases: CVE-2023-22476 |
MantisBT may expose private issues' summaries to unauthorized users ### Impact Due to insufficient access-level checks, any logged-in user allowed … |
Vulnerable |
|
GHSA-j7v9-f46r-2rp4
Aliases: CVE-2026-41897 |
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field Lack of validation of filter_target parameter on return_dynamic_filters.php … |
Vulnerable |
|
GHSA-rmp5-5jj7-gmvf
Aliases: CVE-2026-34744 |
MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue MantisBT permits a user … |
Vulnerable |
|
GHSA-frf7-jhp9-jxm6
Aliases: CVE-2026-34390 |
MantisBT Vulnerable to Privilege Escalation from Manager to Administrator Insufficient access control checks in _ProjectUsersAddCommand_ (used in *manage_proj_user_add.php* and REST … |
Vulnerable |
|
GHSA-qj6w-v29q-4rgx
Aliases: CVE-2026-39960 |
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values Improper escaping of a textarea custom field's contents in … |
Vulnerable |
|
GHSA-h4x5-gvx6-3rwc
Aliases: CVE-2026-34754 |
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API ### Impact MantisBT allows an … |
Vulnerable |
|
GHSA-pq86-j2c2-47f6
Aliases: CVE-2026-42070 |
MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API The mc_issue_update() function in MantisBT allows users having *update_bug_threshold* access … |
Vulnerable |
|
GHSA-6jh4-47v2-4g37
Aliases: CVE-2026-40598 |
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page Improper escaping of the redirection page (retrieved … |
Vulnerable |
|
GHSA-crmx-4p49-46m2
Aliases: CVE-2026-34970 |
MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked MantisBT allows a bugnote author to access … |
Vulnerable |
|
GHSA-fvjf-68wh-rwp2
Aliases: CVE-2026-34463 |
MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form When cloning an issue originating from a Project other … |
Vulnerable |
|
GHSA-p6fr-rxq7-xcg8
Aliases: CVE-2026-44657 |
MantisBT Vulnerable to Stored XSS in File Download Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an … |
Vulnerable |
|
GHSA-9c3j-xm6v-j7j3
Aliases: CVE-2026-40597 |
MantisBT has a Content Security Policy bypass via attachments Given any pre-existing XSS / HTML injection vulnerability, an attacker can … |
Vulnerable |
|
GHSA-phrq-pc6r-f6gh
Aliases: CVE-2026-30849 |
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL Mantis Bug Tracker instances running on MySQL and … |
Vulnerable |
|
GHSA-ggjm-7m5f-7xjv
Aliases: CVE-2018-17782 |
MantisBT allows XSS via the Manage Filter page A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in … |
Vulnerable Vulnerable |
|
GHSA-mjp7-97w4-jwhc
Aliases: CVE-2018-13055 |
MantisBT allows XSS via View Filters page A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT … |
Vulnerable Vulnerable |
|
GHSA-gcqw-45xq-xc63
Aliases: CVE-2018-17783 |
MantisBT allows XSS via Edit Filter page A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in … |
Vulnerable Vulnerable |
|
GHSA-vcrw-4xvv-jh49
Aliases: CVE-2026-52881 |
MantisBT: Reflected XSS in admin/install.php via unescaped printf MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. … |
Not vulnerable |
|
GHSA-c2xg-qjqw-2v98
Aliases: CVE-2026-47156 |
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator MantisBT 2.28.3 and earlier contains a critical authentication bypass in … |
Not vulnerable |
|
GHSA-mw6p-33vw-46cc
Aliases: CVE-2026-47142 |
MantisBT: SQL Injection via history_order Configuration Value MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The … |
Not vulnerable |
|
GHSA-77x8-3v3h-hrhv
Aliases: CVE-2026-52847 |
MantisBT: Reflected XSS in admin/install.php MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are … |
Not vulnerable |
|
GHSA-h2wf-967x-gxvw
Aliases: CVE-2026-62944 |
MantisBT: Stored XSS in print_all_bug_page_word.php A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML … |
Not vulnerable |
|
GHSA-3v2j-6fw9-f57c
Aliases: CVE-2026-52882 |
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters ### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign … |
Not vulnerable |
|
GHSA-4vpf-w7qv-5h3q
Aliases: CVE-2026-52883 |
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows … |
Not vulnerable |
|
GHSA-3qv7-98vm-xx2v
Aliases: CVE-2018-16514 |
MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and … |
Vulnerable Vulnerable |
|
GHSA-4rrc-5vp6-m3f6
Aliases: CVE-2020-16266 |
MantisBT XSS issue on the view_all_bug_page.php An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows … |
Vulnerable Vulnerable |
|
GHSA-74gh-5j33-vg4w
Aliases: CVE-2018-14504 |
MantisBT allows XSS on the Edit Filter page via crafted filter name An issue was discovered in manage_filter_edit_page.php in MantisBT … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-f633-865q-2mhh
Aliases: CVE-2026-40607 |
MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column Incorrect escaping of a saved filter's owner allows an attacker … |
Vulnerable Vulnerable |
|
GHSA-j3v9-553h-x28j
Aliases: CVE-2026-40596 |
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference Any authenticated user can … |
Vulnerable Vulnerable |
|
GHSA-7mqj-8gj2-cg59
Aliases: CVE-2026-44655 |
MantisBT has Stored XSS on Move Attachments Admin Page Unescaped Project Name allows an attacker that can set it (which … |
Vulnerable Vulnerable |
|
GHSA-v84x-qvhg-f36r
Aliases: CVE-2026-49273 |
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php MantisBT 2.28.3 and earlier contains a remote code execution vulnerability … |
Not vulnerable Not vulnerable |
|
GHSA-m7ph-9558-mrx3
Aliases: CVE-2026-49280 |
MantisBT: REST API unauthorized Issue status change A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status … |
Not vulnerable Not vulnerable |