{"kind": "product", "path": "vulns/packagist/mantisbt%2Fmantisbt", "name": "mantisbt/mantisbt", "product": "mantisbt/mantisbt", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-47156", "noindex": false, "published": "2026-09-09T16:06:40.283Z", "modified": "2026-09-10T14:56:41.693Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00686, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47156", "title": "MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator", "description": "MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-c2xg-qjqw-2v98", "https://github.com/mantisbt/mantisbt/commit/e3571c319b1721b41b0dc4b5b5203cbdcbe0c2ee", "https://mantisbt.org/bugs/view.php?id=37121"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-62944", "noindex": false, "published": "2026-07-15T18:56:00Z", "modified": "2026-07-15T19:11:50.363816Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-62944", "title": "MantisBT: Stored XSS in print_all_bug_page_word.php", "description": "A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe.\" onload=\"alert(1)`. \n\nWhen any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes `<img src=\"...\" alt=\"\" onload=\"alert(1)\" />`, breaking out of the alt attribute. \n\n### Impact\nCross-site scripting.\n\nImpact is limited by MantisBT's Content Security Policy.\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa\n\n### Workaroun", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h2wf-967x-gxvw", "https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52883", "noindex": false, "published": "2026-07-15T18:52:20Z", "modified": "2026-07-15T19:11:50.442341Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52883", "title": "MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs", "description": "Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than *$g_time_tracking_view_threshold*, they can also inject arbitrary hours into billing reports.\n\nREST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.\n\n### Impact\nAn attacker with UPDATER access could:\n- Inject fake billable hours via TIME_TRACKING notes (note_type=2),", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4vpf-w7qv-5h3q", "https://github.com/mantisbt/mantisbt/commit/de2f71fd88746e963386c214c3ae65a3c4c851b7", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52882", "noindex": false, "published": "2026-07-15T18:41:55Z", "modified": "2026-07-15T19:11:50.290742Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52882", "title": "MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters", "description": "### Impact\nUsers below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions.\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f\n\n### Workarounds\nNone\n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37065\n\n### Credits\nMantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-3v2j-6fw9-f57c", "https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52881", "noindex": false, "published": "2026-07-15T18:34:36Z", "modified": "2026-07-15T19:11:50.525745Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52881", "title": "MantisBT: Reflected XSS in admin/install.php via unescaped printf ", "description": "MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required.\n\nA Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.\n\n### Impact\n- Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.\n- Open redir", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-vcrw-4xvv-jh49", "https://github.com/mantisbt/mantisbt/commit/297773fbb238c39a153bd888431b41a176132098", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52847", "noindex": false, "published": "2026-07-15T18:25:36Z", "modified": "2026-07-15T18:41:49.232123Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52847", "title": "MantisBT: Reflected XSS in admin/install.php", "description": "MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required.\n\nA Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.\n\n### Impact\n- Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.\n- Open redirect: Victim is", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-77x8-3v3h-hrhv", "https://github.com/mantisbt/mantisbt/commit/0f32ceabadc745239754962df91a51d5d51e3fd7", "https://github.com/mantisbt/mantisbt/commit/f2191a0d8ce438bf74171d496cf721dae025a5c0"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49280", "noindex": false, "published": "2026-07-15T17:02:12Z", "modified": "2026-07-15T17:26:45.365099Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49280", "title": "MantisBT: REST API unauthorized Issue status change", "description": "A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default).\n\n### Impact\nUnauthorized change in Issue workflow.\n\n### Patches\nhttps://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4\n\n### Workarounds\nNone\n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37181\n\n### Credits\nMamdouh Mahfouz (@mamdouhmahfouz)", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-m7ph-9558-mrx3", "https://github.com/mantisbt/mantisbt/commit/2d3a5537605487a1ec5178aba9fe9b5623b6a4e0", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49273", "noindex": false, "published": "2026-07-15T16:52:24Z", "modified": "2026-07-15T17:11:43.450788Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49273", "title": "MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php", "description": "MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin \"Manage Configuration\" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls *eval()* with a `return;` prefix intended to prevent code execution.\n\nHowever, PHP hoists function and class declarations at compile time, even past a *return* statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution.\n\nThis vulnerability requires administrator", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v84x-qvhg-f36r", "https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47142", "noindex": false, "published": "2026-07-15T16:38:22Z", "modified": "2026-07-15T16:56:40.831437Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47142", "title": "MantisBT: SQL Injection via history_order Configuration Value", "description": "MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist.\n\nAn administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries.\n\n### Impact\n- Sensitive data extraction from the entire bugtracker database including user credentials (cookie_string, password hashes), API tokens, and private issue d", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mw6p-33vw-46cc", "https://github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325", "https://github.com/mantisbt/mantisbt"], "fixes": ["2.28.4"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42071", "noindex": false, "published": "2026-05-28T20:29:20.361Z", "modified": "2026-05-29T13:56:52.065Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0026, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42071", "title": "MantisBT: Private Bugnote Attachment Content Leak via REST API", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint. This vulnerability is fixed in 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pw5x-2mf9-3xc8", "https://github.com/mantisbt/mantisbt/commit/029d9d203d9e4ae96b3e59d552fa7395cc1e5071", "https://mantisbt.org/bugs/view.php?id=27039"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42070", "noindex": false, "published": "2026-05-28T20:28:20.369Z", "modified": "2026-06-02T13:50:27.406Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00258, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42070", "title": "MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, the mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. This vulnerability is fixed in 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pq86-j2c2-47f6", "https://github.com/mantisbt/mantisbt/commit/6e58fae4f22efdc3987f903c8ba2611de17a9435", "https://mantisbt.org/bugs/view.php?id=37089"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44655", "noindex": false, "published": "2026-05-28T20:27:02.724Z", "modified": "2026-05-29T19:12:11.191Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44655", "title": "MantisBT: Stored XSS on Move Attachments Admin Page", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. This vulnerability is fixed in 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59", "https://github.com/mantisbt/mantisbt/commit/5cb4b469295889f5d2b01677c9bf82c143e0fdaa", "https://nvd.nist.gov/vuln/detail/CVE-2026-44655"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41897", "noindex": false, "published": "2026-05-28T20:26:24.192Z", "modified": "2026-05-30T02:15:20.499Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41897", "title": "MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This vulnerability is fixed in 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4", "https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4", "https://mantisbt.org/bugs/view.php?id=37013"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44657", "noindex": false, "published": "2026-05-28T20:25:26.816Z", "modified": "2026-05-29T14:50:03.745Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44657", "title": "MantisBT: Stored XSS in File Download", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-p6fr-rxq7-xcg8", "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3", "https://github.com/mantisbt/mantisbt/commit/26647b2e68ba30b9d7987d4e03d7a16416684bc2"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-40607", "noindex": false, "published": "2026-05-22T19:39:13.817Z", "modified": "2026-05-26T18:51:17.022Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00419, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-40607", "title": "MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of a saved filter's owner, allowing an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON. Note that By default, only users with Manager access level or above can save their filters publicly. This issue has been fixed in version 2.28.2. If developers are unable to update immediately, they can work around this issue by preventing display of users' real names (set $g_ show_user_realname = OFF; in configuration), and restricting the ability to store filters (set $g", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-f633-865q-2mhh", "https://github.com/mantisbt/mantisbt/commit/44f490bcf20fd491c1b8f3fc9dd041d8c2a30010", "https://mantisbt.org/bugs/view.php?id=37015"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-40598", "noindex": false, "published": "2026-05-22T19:32:35.535Z", "modified": "2026-05-23T02:41:23.021Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00447, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-40598", "title": "MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37", "https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9", "https://mantisbt.org/bugs/view.php?id=37017"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-40597", "noindex": false, "published": "2026-05-22T19:29:46.728Z", "modified": "2026-05-26T19:06:00.401Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00498, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-40597", "title": "MantisBT has a Content Security Policy bypass via attachments", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3", "https://github.com/mantisbt/mantisbt/commit/9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe", "https://mantisbt.org/bugs/view.php?id=37016"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-40596", "noindex": false, "published": "2026-05-22T19:25:32.812Z", "modified": "2026-05-22T20:10:16.176Z", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L", "severity": "high", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-40596", "title": "MantisBT is vulnerable to XSS and potential account takeover via user font family preference update", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j3v9-553h-x28j", "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3", "https://github.com/mantisbt/mantisbt/commit/9e8409cdd979eba86ef532756fc47c1d8112d22d"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39960", "noindex": false, "published": "2026-05-20T21:11:02.341Z", "modified": "2026-05-21T13:30:07.497Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39960", "title": "MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-qj6w-v29q-4rgx", "https://github.com/mantisbt/mantisbt/commit/5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7", "https://nvd.nist.gov/vuln/detail/CVE-2026-39960"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34970", "noindex": false, "published": "2026-05-19T23:17:59.549Z", "modified": "2026-05-20T13:04:48.598Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34970", "title": "MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked", "description": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.", "references": ["https://github.com/mantisbt/mantisbt/security/advisories/GHSA-crmx-4p49-46m2", "https://github.com/mantisbt/mantisbt/commit/71df1f67e05b2050cd4bd87839e6cc13747cf03f", "https://mantisbt.org/bugs/view.php?id=36978"], "fixes": ["2.28.2"], "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}]}], "total": 74, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "mantisbt/mantisbt", "path": "vulns/packagist/mantisbt%2Fmantisbt", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["2.28.3", "2.28.2", "2.28.1", "2.28.0", "2.27.3", "2.27.2", "2.27.1", "2.27.0", "2.26.4", "2.26.3", "2.26.2", "2.26.1"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T14:56:41.693Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}