en
MantisBT is an open-source web-based bug and issue tracker maintained by the MantisBT project community. Its primary purpose is to help software teams record, triage, discuss, assign, and resolve defects and related project issues. It is commonly deployed as a self-hosted PHP application for development and operational teams.
As of 09/13/2026, mantisbt recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, mantisbt had the most security vulnerabilities in the mantisbt ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-47156MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published09/09/2026 | SeverityCritical |
CVE-2026-42071MantisBT: Private Bugnote Attachment Content Leak via REST API | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/28/2026 | SeverityHigh |
CVE-2026-42070MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/28/2026 | SeverityMedium |
CVE-2026-44655MantisBT: Stored XSS on Move Attachments Admin Page | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/28/2026 | SeverityHigh |
CVE-2026-41897MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/28/2026 | SeverityMedium |
CVE-2026-44657MantisBT: Stored XSS in File Download | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/28/2026 | SeverityHigh |
CVE-2026-40607MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/22/2026 | SeverityHigh |
CVE-2026-40598MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published05/22/2026 | SeverityMedium |
CVE-2026-40597MantisBT has a Content Security Policy bypass via attachments | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/22/2026 | SeverityHigh |
CVE-2026-40596MantisBT is vulnerable to XSS and potential account takeover via user font family preference update | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/22/2026 | SeverityHigh |
CVE-2026-39960MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/20/2026 | SeverityMedium |
CVE-2026-34970MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-34754MantisBT allows unauthorized users to upload attachments to restricted issues via REST API | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-34744MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-34579MantisBT has an authorization bypass via private issue monitoring | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-34463MantisBT has Stored HTML Injection/XSS via Clone Issue Form | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityHigh |
CVE-2026-34390MantisBT: Privilege Escalation from Manager to Administrator | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-33052MantisBT: Authorization Bypass in Global Profile Creation | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published05/19/2026 | SeverityMedium |
CVE-2026-33548MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published03/23/2026 | SeverityHigh |
CVE-2026-33517MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published03/23/2026 | SeverityHigh |
CVE-2026-30849MantisBT SOAP API has an authentication bypass vulnerability on MySQL | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published03/23/2026 | SeverityCritical |
CVE-2025-62520MantisBT unauthorized disclosure of private project column configuration | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published11/04/2025 | SeverityMedium |
CVE-2025-55155MantisBT: Authentication bypass for some passwords due to PHP type juggling | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published11/04/2025 | SeverityMedium |
CVE-2025-47776MantisBT: Authentication bypass for some passwords due to PHP type juggling | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published11/04/2025 | SeverityHigh |
CVE-2025-46556MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published11/04/2025 | SeverityMedium |
CVE-2024-45792MantisBT vulnerable to information disclosure with user profiles | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published09/30/2024 | SeverityMedium |
CVE-2024-34081MantisBT Cross-site Scripting vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published05/13/2024 | SeverityMedium |
CVE-2024-34080MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published05/13/2024 | SeverityMedium |
CVE-2024-34077MantisBT user account takeover in the signup/reset password process | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published05/13/2024 | SeverityHigh |
CVE-2024-23830MantisBT Host Header Injection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productmantisbt | Published02/20/2024 | SeverityHigh |
CVE-2023-49802MantisBT LinkedCustomFields Cross-site Scripting vulnerability | Exploitation statusNot known exploited | FixYes | Affected productLinkedCustomFields | Published12/11/2023 | SeverityMedium |
CVE-2023-44394Disclosure of project names to unauthorized users in MantisBT | Exploitation statusNot known exploited | FixNot confirmed | Affected productmantisbt | Published10/16/2023 | SeverityMedium |
CVE-2023-22476MantisBT: Exposure of Private issues' summary to unauthorized users | Exploitation statusPublic exploit | FixYes | Affected productmantisbt | Published02/23/2023 | SeverityMedium |
CVE-2022-33910 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/24/2022 | SeverityUnknown |
CVE-2022-28508 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/04/2022 | SeverityUnknown |
CVE-2021-43257 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/14/2022 | SeverityUnknown |
CVE-2022-26144 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/13/2022 | SeverityUnknown |
CVE-2021-33557 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/17/2021 | SeverityUnknown |
CVE-2009-20001 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/07/2021 | SeverityUnknown |
CVE-2020-35571 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/22/2021 | SeverityUnknown |
CVE-2020-29604 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2021 | SeverityUnknown |
CVE-2020-29605 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2021 | SeverityUnknown |
CVE-2020-29603 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2021 | SeverityUnknown |
CVE-2020-36192 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/18/2021 | SeverityUnknown |
CVE-2020-28413 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/30/2020 | SeverityMedium |
CVE-2020-35849 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/30/2020 | SeverityUnknown |
CVE-2020-25830 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/30/2020 | SeverityUnknown |
CVE-2020-25781 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/30/2020 | SeverityUnknown |
CVE-2020-25288 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/30/2020 | SeverityUnknown |
CVE-2020-16266 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/12/2020 | SeverityUnknown |
CVE-2019-15539 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/19/2020 | SeverityUnknown |
CVE-2020-8981 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2009-2802 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/09/2019 | SeverityUnknown |
CVE-2013-1811 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmantis | Published11/07/2019 | SeverityUnknown |
CVE-2013-1934 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmantisbt | Published10/31/2019 | SeverityUnknown |
CVE-2013-1932 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmantisbt | Published10/31/2019 | SeverityUnknown |
CVE-2013-1931 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmantisbt | Published10/31/2019 | SeverityUnknown |
CVE-2013-1930 | Exploitation statusNot confirmed | FixNot confirmed | Affected productmantisbt | Published10/31/2019 | SeverityUnknown |
CVE-2019-15715 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/09/2019 | SeverityUnknown |
CVE-2019-15074 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/21/2019 | SeverityUnknown |
CVE-2018-16514 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/20/2019 | SeverityUnknown |
CVE-2018-9839 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/06/2019 | SeverityUnknown |
CVE-2018-17783 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/30/2018 | SeverityUnknown |
CVE-2018-17782 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/30/2018 | SeverityUnknown |
CVE-2018-16362 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2018 | SeverityUnknown |
CVE-2018-13055 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/03/2018 | SeverityUnknown |
CVE-2018-14504 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/03/2018 | SeverityUnknown |
CVE-2018-6526 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/02/2018 | SeverityUnknown |
CVE-2018-6382 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/30/2018 | SeverityUnknown |
CVE-2014-9624 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/12/2017 | SeverityUnknown |
CVE-2015-2046 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/28/2017 | SeverityUnknown |
CVE-2014-9701 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/09/2017 | SeverityUnknown |
CVE-2017-12419 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/05/2017 | SeverityUnknown |
CVE-2017-12061 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/01/2017 | SeverityUnknown |
CVE-2017-12062 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/01/2017 | SeverityUnknown |
CVE-2015-5059 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/01/2017 | SeverityUnknown |
CVE-2017-7620 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published05/21/2017 | SeverityUnknown |
CVE-2017-7897 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/18/2017 | SeverityUnknown |
CVE-2017-7615 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/16/2017 | SeverityUnknown |
CVE-2017-7309 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published03/31/2017 | SeverityUnknown |
CVE-2017-7241 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published03/31/2017 | SeverityUnknown |
CVE-2017-6973 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published03/31/2017 | SeverityUnknown |
CVE-2017-7222 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/22/2017 | SeverityUnknown |
CVE-2017-6958 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/17/2017 | SeverityUnknown |
CVE-2017-6799 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/10/2017 | SeverityUnknown |
CVE-2017-6797 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/10/2017 | SeverityUnknown |
CVE-2016-7111 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/17/2017 | SeverityUnknown |
CVE-2016-5364 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/17/2017 | SeverityUnknown |
CVE-2016-6837 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/10/2017 | SeverityUnknown |
CVE-2014-9759 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/11/2016 | SeverityUnknown |
CVE-2014-8987 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/24/2015 | SeverityUnknown |
CVE-2015-1042 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/10/2015 | SeverityUnknown |
CVE-2014-9572 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2015 | SeverityUnknown |
CVE-2014-9571 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2015 | SeverityUnknown |
CVE-2014-9573 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2015 | SeverityUnknown |
CVE-2014-9269 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/09/2015 | SeverityUnknown |
CVE-2014-9271 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/09/2015 | SeverityUnknown |
CVE-2014-9272 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/09/2015 | SeverityUnknown |
CVE-2014-9506 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/04/2015 | SeverityUnknown |
CVE-2014-8553 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2014 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
