VulertSecurity VulertSecurity

Vulnerability Database · Packagist · mantisbt/mantisbt · Version

mantisbt/mantisbt 2.25.0

2.25.0 is affected by 42 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 4 High 14 Medium 23 Low 1 Unrated 0

All mantisbt/mantisbt versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

mantisbt/mantisbt 2.25.0 vulnerabilities

42 vulnerabilities cover mantisbt/mantisbt 2.25.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-47156: MantisBT Critical SOAP API Authentication Bypass and Privilege Escalation 9.3 critical 2.28.4 15 Jul 2026
CVE-2026-30849: MantisBT Authentication Bypass Vulnerability via SOAP API on MySQL 9.3 critical 2.28.1 23 Mar 2026
CVE-2026-52881: MantisBT Reflected XSS Vulnerability in admin/install.php 9.2 critical 2.28.4 15 Jul 2026
CVE-2026-52847: MantisBT Reflected XSS Vulnerability in admin/install.php 9.2 critical 2.28.4 15 Jul 2026
CVE-2025-47776: MantisBT Authentication Bypass Due to PHP Type Juggling 8.8 high 2.27.2 03 Nov 2025
CVE-2026-62944: MantisBT Stored XSS Vulnerability in print_all_bug_page_word.php 8.6 high 2.28.4 15 Jul 2026
CVE-2026-49273: MantisBT Remote Code Execution via eval() Class Hoisting Vulnerability 8.6 high 2.28.4 15 Jul 2026
CVE-2026-44655: MantisBT Stored XSS Vulnerability in Move Attachments Admin Page 8.6 high 2.28.2 11 May 2026
CVE-2026-34463: MantisBT Vulnerable to Stored HTML Injection/XSS in Clone Issue Form 8.6 high 2.28.2 11 May 2026
CVE-2026-47142: MantisBT SQL Injection Vulnerability in history_order Configuration 8.5 high 2.28.4 15 Jul 2026
CVE-2024-23830: MantisBT Host Header Injection vulnerability 8.3 high 2.26.1 20 Feb 2024
CVE-2021-43257: MantisBT CSV Injection Vulnerability Allows Unprivileged User Access 7.8 high 2.25.3 15 Apr 2022
CVE-2026-40597: MantisBT Content Security Policy Bypass via Attachments 7.6 high 2.28.2 11 May 2026
CVE-2026-44657: MantisBT Stored XSS Vulnerability in File Download Functionality 7.5 high 2.28.2 11 May 2026
CVE-2026-40607: MantisBT Stored XSS Vulnerability in Saved-Filter Owner Column 7.5 high 2.28.2 11 May 2026
User Account Takeover in Mantis Bug Tracker (MantisBT) 7.3 high 2.26.2 13 May 2024
CVE-2026-42071: MantisBT Private Bugnote Attachment Content Leak via REST API 7.2 high 2.28.2 11 May 2026
CVE-2026-40596: MantisBT XSS Vulnerability Leading to Account Takeover via Font Family Preference Update 7.2 high 2.28.2 11 May 2026
CVE-2026-40598: MantisBT Reflected HTML Injection Vulnerability in Tag Update Page 6.9 medium 2.28.2 11 May 2026
Cross-Site Scripting Vulnerability in Mantis Bug Tracker (MantisBT) 6.6 medium 2.26.2 13 May 2024
CVE-2025-46556: MantisBT Denial-of-Service Vulnerability via Excessive Note Length 6.5 medium 2.27.2 03 Nov 2025
CVE-2021-33557: MantisBT XSS Vulnerability in manage_custom_field_edit_page.php 6.1 medium 2.25.2 24 May 2022
CVE-2022-28508: MantisBT XSS Vulnerability in browser_search_plugin.php 6.1 medium No fix published 05 May 2022
CVE-2022-26144: MantisBT XSS Vulnerability Due to Improper Escaping 6.1 medium 2.25.3 14 Apr 2022
CVE-2026-39960: MantisBT Vulnerable to Stored XSS in Custom Field Textarea Values 5.4 medium 2.28.2 11 May 2026
CVE-2025-55155: MantisBT Email Address Change Vulnerability 5.4 medium 2.27.2 03 Nov 2025
CVE-2022-33910: MantisBT XSS Vulnerability via Crafted SVG Documents 5.4 medium 2.25.5 25 Jun 2022
CVE-2026-52883: MantisBT Vulnerability Allows Injection of TIME_TRACKING and REMINDER Notes via APIs 5.3 medium 2.28.4 15 Jul 2026
CVE-2026-52882: MantisBT REST and SOAP API Vulnerability Allows Assignment of Unreleased Product Versions 5.3 medium 2.28.4 15 Jul 2026
CVE-2026-49280: MantisBT Unauthorized Issue Status Change via REST API 5.3 medium 2.28.4 15 Jul 2026
CVE-2026-42070: MantisBT Authorization Bypass in Bugnote Editing via Issue Update API 5.3 medium 2.28.2 11 May 2026
CVE-2026-41897: MantisBT Reflected XSS Vulnerability in Dynamic Custom Textarea Field 5.3 medium 2.28.2 11 May 2026
CVE-2026-34970: MantisBT Bugnote Revision Page Exposes Private Issue Metadata 5.3 medium 2.28.2 11 May 2026
CVE-2026-34744: MantisBT Authorization Bypass Allows Access to Private Issue Attachments 5.3 medium 2.28.2 11 May 2026
CVE-2025-62520: MantisBT Unauthorized Disclosure of Private Project Column Configuration 5.3 medium 2.27.2 03 Nov 2025
MantisBT Vulnerable to Exposure of Sensitive Information 5.3 medium 2.26.2 13 May 2024
CVE-2026-34390: MantisBT Privilege Escalation Vulnerability 5.1 medium 2.28.2 11 May 2026
CVE-2026-34754: MantisBT Authorization Bypass Allows Uploading Attachments to Private Issues 4.3 medium 2.28.2 11 May 2026
Information Disclosure Vulnerability in MantisBT - User Profile Exposure 4.3 medium 2.26.4 30 Sep 2024
MantisBT: Unauthorized Disclosure of Project Names 4.3 medium 2.25.8 17 Oct 2023
CVE-2023-22476: MantisBT exposes private issues' summaries to unauthorized users 4.3 medium 2.25.6 23 Feb 2023
CVE-2010-2574: MantisBT Cross-site Scripting Vulnerability in manage_proj_cat_add.php 1.1 low No fix published 14 May 2022

Looking for another version, or everything Vulert holds for mantisbt/mantisbt?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About mantisbt/mantisbt 2.25.0

Is mantisbt/mantisbt 2.25.0 vulnerable?

Yes. 42 vulnerabilities in the Vulert database cover mantisbt/mantisbt 2.25.0: 4 critical, 14 high, 23 medium and 1 low. Each entry above names the fixed version to move to.

How do I monitor mantisbt/mantisbt for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the mantisbt/mantisbt version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.