Search for packages
| purl | pkg:composer/mantisbt/mantisbt@2.28.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-vcrw-4xvv-jh49
Aliases: CVE-2026-52881 |
MantisBT: Reflected XSS in admin/install.php via unescaped printf MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. … |
Not vulnerable |
|
GHSA-c2xg-qjqw-2v98
Aliases: CVE-2026-47156 |
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator MantisBT 2.28.3 and earlier contains a critical authentication bypass in … |
Not vulnerable |
|
GHSA-mw6p-33vw-46cc
Aliases: CVE-2026-47142 |
MantisBT: SQL Injection via history_order Configuration Value MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The … |
Not vulnerable |
|
GHSA-77x8-3v3h-hrhv
Aliases: CVE-2026-52847 |
MantisBT: Reflected XSS in admin/install.php MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are … |
Not vulnerable |
|
GHSA-h2wf-967x-gxvw
Aliases: CVE-2026-62944 |
MantisBT: Stored XSS in print_all_bug_page_word.php A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML … |
Not vulnerable |
|
GHSA-3v2j-6fw9-f57c
Aliases: CVE-2026-52882 |
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters ### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign … |
Not vulnerable |
|
GHSA-4vpf-w7qv-5h3q
Aliases: CVE-2026-52883 |
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows … |
Not vulnerable |
|
GHSA-v84x-qvhg-f36r
Aliases: CVE-2026-49273 |
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php MantisBT 2.28.3 and earlier contains a remote code execution vulnerability … |
Not vulnerable Not vulnerable |
|
GHSA-m7ph-9558-mrx3
Aliases: CVE-2026-49280 |
MantisBT: REST API unauthorized Issue status change A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status … |
Not vulnerable Not vulnerable |