mantisbt/mantisbt vulnerabilities
CVEs whose affected-version data names the mantisbt/mantisbt package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
CVE-2026-52883MediumMantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
▾ Sunlitmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-62944HighMantisBT: Stored XSS in print_all_bug_page_word.php
MantisBT: Stored XSS in print_all_bug_page_word.php
▾ Twilightmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-52847CriticalMantisBT: Reflected XSS in admin/install.php
MantisBT: Reflected XSS in admin/install.php
▾ Midnightmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-52881CriticalMantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT: Reflected XSS in admin/install.php via unescaped printf
▾ Midnightmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-52882MediumMantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
▾ Sunlitmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-49273HighMantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
▾ Twilightmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-49280MediumMantisBT: REST API unauthorized Issue status change
MantisBT: REST API unauthorized Issue status change
▾ Sunlitmantisbt · mantisbt/mantisbtvia GHSA
CVE-2026-47142HighMantisBT: SQL Injection via history_order Configuration Value
MantisBT: SQL Injection via history_order Configuration Value
▾ Twilightmantisbt · mantisbt/mantisbtvia GHSA