Known vulnerabilities in MantisBT

Software: MantisBT
Software CPE: cpe:2.3:a:mantisbt_sourceforge_net:mantisbt:*:*:*:*:*:*:*:*
Total vulnerabilities: 68
Public exploits: 7
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting MantisBT MantisBT is affected by 68 known vulnerabilities: 28 medium, 40 low Critical High Medium Low

Vulnerabilities (68)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118156 - Exposure of sensitive information to an unauthorized actor
CVE-2025-62520
CWE-200 Medium
No
No
2.27.2 06.11.2025 SB2025110622
#VU118155 - Insufficient Verification of Data Authenticity
CVE-2025-55155
CWE-345 Medium
No
No
2.27.2 06.11.2025 SB2025110622
#VU118154 - Authentication Bypass by Primary Weakness
CVE-2025-47776
CWE-305 Medium
No
No
2.27.2 06.11.2025 SB2025110622
#VU118153 - Allocation of Resources Without Limits or Throttling
CVE-2025-46556
CWE-770 Medium
No
No
2.27.2 06.11.2025 SB2025110622
#VU89375 - Authentication Bypass by Primary Weakness
CVE-2024-34077
CWE-305 Medium
No
No
2.26.2 13.05.2024 SB2024051317
#VU89374 - Exposure of sensitive information to an unauthorized actor
CVE-2024-34080
CWE-200 Low
No
No
2.26.2 13.05.2024 SB2024051317
#VU89373 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-34081
CWE-79 Low
No
No
2.26.2 13.05.2024 SB2024051317
#VU64727 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-33910
CWE-79 Low
No
No
2.25.5 28.06.2022 SB2022062809
#VU49274 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-28413
CWE-89 Medium
No
No
2.24.4 30.12.2020 SB2021010508
#VU49275 - Improper Access Control
CVE-2020-35849
CWE-284 Medium
No
No
2.24.4 30.12.2020 SB2021010508
#VU45856 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-16266
CWE-79 Low
No
No
2.24.2 12.08.2020 SB2020081277
#VU30329 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-15539
CWE-79 Low
No
No
2.21.3 19.03.2020 SB2020031936
#VU30629 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2009-2802
CWE-79 Low
No
No
1.2.2 09.11.2019 SB2019110907
#VU30630 - Improper input validation
CVE-2013-1811
CWE-20 Low
No
No
1.2.13 08.11.2019 SB2019110808
#VU35129 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2013-1932
CWE-79 Low
No
No
1.2.14 31.10.2019 SB2019103122
#VU30719 - Improper input validation
CVE-2013-1930
CWE-20 Low
No
No
1.2.15 31.10.2019 SB2019103118
#VU30729 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2019-15715
CWE-78 Medium
Available
No
2.22.1 09.10.2019 SB2019100938
#VU18913 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-16514
CWE-79 Medium
No
No
2.17.1 25.06.2019 SB2019062601
#VU18912 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-13055
CWE-79 Medium
No
No
2.15.1, 2.17.1 25.06.2019 SB2018080310
SB2019062601
SB2019080617
#VU38414 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-2046
CWE-79 Low
No
No
1.2.20 28.08.2017 SB2017082814


Showing elements 1 - 20 out of 68