受影响的版本系列
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-47156 | MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator | * | 9.3 | — | 2026-09-10 | |
| CVE-2026-42071 | MantisBT: Private Bugnote Attachment Content Leak via REST API | * | 7.2 | — | 2026-05-29 | |
| CVE-2026-42070 | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API | * | 5.3 | — | 2026-05-29 | |
| CVE-2026-44655 | MantisBT: Stored XSS on Move Attachments Admin Page | * | 8.6 | — | 2026-05-29 | |
| CVE-2026-41897 | MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field | * | 5.3 | — | 2026-05-29 | |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | * | 7.5 | — | 2026-05-29 | |
| CVE-2026-40607 | MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column | * | 7.5 | — | 2026-05-23 | |
| CVE-2026-40598 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | * | 6.9 | — | 2026-05-23 | |
| CVE-2026-40597 | MantisBT has a Content Security Policy bypass via attachments | * | 7.6 | — | 2026-05-23 | |
| CVE-2026-40596 | MantisBT is vulnerable to XSS and potential account takeover via user font family preference update | * | 7.2 | — | 2026-05-23 | |
| CVE-2026-39960 | MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values | * | 5.4 | — | 2026-05-21 | |
| CVE-2026-34970 | MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked | * | 5.3 | — | 2026-05-20 | |
| CVE-2026-34754 | MantisBT allows unauthorized users to upload attachments to restricted issues via REST API | * | 4.3 | — | 2026-05-20 | |
| CVE-2026-34744 | MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues | * | 5.3 | — | 2026-05-20 | |
| CVE-2026-34579 | MantisBT has an authorization bypass via private issue monitoring | * | 5.3 | — | 2026-05-20 | |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | * | 8.6 | — | 2026-05-20 | |
| CVE-2026-34390 | MantisBT: Privilege Escalation from Manager to Administrator | * | 5.1 | — | 2026-05-20 | |
| CVE-2026-33052 | MantisBT: Authorization Bypass in Global Profile Creation | * | 5.3 | — | 2026-05-19 | |
| CVE-2026-33548 | MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline | * | 8.6 | — | 2026-03-24 | |
| CVE-2026-33517 | MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation | * | 8.6 | — | 2026-03-24 | |
| CVE-2026-30849 | MantisBT SOAP API has an authentication bypass vulnerability on MySQL | * | 9.3 | — | 2026-03-24 | |
| CVE-2025-62520 | MantisBT unauthorized disclosure of private project column configuration | * | 5.3 | — | 2025-11-05 | |
| CVE-2025-55155 | MantisBT: Authentication bypass for some passwords due to PHP type juggling | * | 5.4 | — | 2025-11-05 | |
| CVE-2025-47776 | MantisBT: Authentication bypass for some passwords due to PHP type juggling | * | 8.8 | — | 2025-11-05 | |
| CVE-2025-46556 | MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length | * | 6.5 | — | 2025-11-04 | |
| CVE-2024-45792 | MantisBT vulnerable to information disclosure with user profiles | * | 5.3 | — | 2024-09-30 | |
| CVE-2024-34081 | MantisBT Cross-site Scripting vulnerability | * | 6.6 | — | 2024-05-14 | |
| CVE-2024-34080 | MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | * | 5.3 | — | 2024-05-14 | |
| CVE-2024-34077 | MantisBT user account takeover in the signup/reset password process | * | 7.3 | — | 2024-05-14 | |
| CVE-2024-23830 | MantisBT Host Header Injection vulnerability | * | 8.3 | — | 2024-02-21 | |
| CVE-2023-44394 | Disclosure of project names to unauthorized users in MantisBT | * | 4.3 | — | 2023-10-17 | |
| CVE-2023-22476 | MantisBT: Exposure of Private issues' summary to unauthorized users | * | 4.3 | — | 2023-02-24 | |
| CVE-2021-43257 | Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged att... | * | — | — | 2022-04-15 | |
| CVE-2020-25830 | An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attack... | * | — | — | 2020-10-01 | |
| CVE-2020-25781 | An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private i... | * | — | — | 2020-10-01 | |
| CVE-2020-25288 | An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field wit... | * | — | — | 2020-10-01 | |
| CVE-2019-15539 | The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scr... | * | — | — | 2020-03-20 | |
| CVE-2013-1934 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisB... | = 1.2.0rc1 before 1.2.14 | — | — | 2019-11-01 | |
| CVE-2013-1932 | A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisB... | = 1.2.13 | — | — | 2019-11-01 | |
| CVE-2013-1931 | A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web... | = 1.2.14 | — | — | 2019-11-01 | |
| CVE-2013-1930 | MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. | = 1.2.12 before 1.2.15 | — | — | 2019-11-01 | |
| CVE-2019-15715 | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Executi... | * | — | — | 2019-10-10 | |
| CVE-2019-15074 | The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vu... | * | — | — | 2019-08-22 | |
| CVE-2018-9839 | An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php... | * | — | — | 2019-06-07 | |
| CVE-2018-14504 | An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting... | * | — | — | 2018-08-04 | |
| CVE-2018-13055 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0... | * | — | — | 2018-08-04 | |
| CVE-2018-6526 | view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the... | * | — | — | 2018-02-02 | |
| CVE-2014-9701 | Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote... | * | — | — | 2017-08-10 | |
| CVE-2017-12062 | An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sa... | * | — | — | 2017-08-02 | |
| CVE-2017-12061 | An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variable... | * | — | — | 2017-08-02 | |
| CVE-2015-5059 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_vie... | * | — | — | 2017-08-01 | |
| CVE-2017-7897 | A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in... | * | — | — | 2017-04-19 | |
| CVE-2017-7222 | A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrar... | * | — | — | 2017-03-22 | |
| CVE-2017-6799 | A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote att... | * | — | — | 2017-03-10 | |
| CVE-2017-6797 | A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x befo... | * | — | — | 2017-03-10 | |
| CVE-2016-7111 | MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar... | * | — | — | 2017-02-18 | |
| CVE-2016-5364 | Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier a... | * | — | — | 2017-02-18 | |
| CVE-2016-6837 | Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versio... | * | — | — | 2017-01-11 | |
| CVE-2014-8987 | Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_... | * | — | — | 2015-08-25 | |
| CVE-2014-9571 | Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0... | * | — | — | 2015-01-27 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。