mantisbt has 9 CVEs on record. Disclosures have slowed: 1 in the last 90 days after 8 in the 90 before. The busiest recent month was July 2026 with 8. The median CVSS is 9.3 (critical), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: mantisbt/mantisbt (8), mantisbt (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.3
- Publish → KEV
- —
- Last 90 days
- 1 prev 8
Worst active — by depth score
CVE-2026-52881CriticalMantisBT: Reflected XSS in admin/install.php via unescaped printf 52CVE-2026-52847CriticalMantisBT: Reflected XSS in admin/install.php52CVE-2026-47156Critical· 9.3MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator51CVE-2026-62944HighMantisBT: Stored XSS in print_all_bug_page_word.php41CVE-2026-49273HighMantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php41
mantisbt vulnerabilities
CVEs affecting mantisbt, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-47156Critical· 9.3MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowi…
CVE-2026-52883MediumMantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
CVE-2026-62944HighMantisBT: Stored XSS in print_all_bug_page_word.php
MantisBT: Stored XSS in print_all_bug_page_word.php
CVE-2026-52847CriticalMantisBT: Reflected XSS in admin/install.php
MantisBT: Reflected XSS in admin/install.php
CVE-2026-52881CriticalMantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT: Reflected XSS in admin/install.php via unescaped printf
CVE-2026-52882MediumMantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
CVE-2026-49273HighMantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
CVE-2026-49280MediumMantisBT: REST API unauthorized Issue status change
MantisBT: REST API unauthorized Issue status change
CVE-2026-47142HighMantisBT: SQL Injection via history_order Configuration Value
MantisBT: SQL Injection via history_order Configuration Value