Search for packages
| purl | pkg:composer/mantisbt/mantisbt@2.28.4 |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-vcrw-4xvv-jh49
|
MantisBT: Reflected XSS in admin/install.php via unescaped printf MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. … |
CVE-2026-52881
|
|
GHSA-c2xg-qjqw-2v98
|
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator MantisBT 2.28.3 and earlier contains a critical authentication bypass in … |
CVE-2026-47156
|
|
GHSA-mw6p-33vw-46cc
|
MantisBT: SQL Injection via history_order Configuration Value MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The … |
CVE-2026-47142
|
|
GHSA-77x8-3v3h-hrhv
|
MantisBT: Reflected XSS in admin/install.php MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are … |
CVE-2026-52847
|
|
GHSA-h2wf-967x-gxvw
|
MantisBT: Stored XSS in print_all_bug_page_word.php A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML … |
CVE-2026-62944
|
|
GHSA-3v2j-6fw9-f57c
|
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters ### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign … |
CVE-2026-52882
|
|
GHSA-4vpf-w7qv-5h3q
|
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows … |
CVE-2026-52883
|
|
GHSA-v84x-qvhg-f36r
|
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php MantisBT 2.28.3 and earlier contains a remote code execution vulnerability … |
CVE-2026-49273
|
|
GHSA-m7ph-9558-mrx3
|
MantisBT: REST API unauthorized Issue status change A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status … |
CVE-2026-49280
|