MantisBT < 2.25.2 - Cross-Site Scripting

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. id: CVE-2022-28508 info: name: MantisBT 2.25.2 -...

MantisBT < 2.28.1 - SOAP API Authentication Bypass

Mantis Bug Tracker 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. id:...

CVE-2026-30849-PoC

CVE-2026-30849.ts — usage This TypeScript script performs a check and an exploit for MantisBT via SOAP. Prerequisites Node.js installed Dependencies installed: npm install Command ts-node CVE-2026-30849.ts check --url ts-node CVE-2026-30849.ts exploit --url npx ts-node .\CVE-2026-30849.ts check...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

EUVD-2026-75087

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user holding a valid cookie_string (obtainable from the MANTIS_STRING_COOKIE browser cookie after login) can authenticate as any other user by supplying that cookie_stri...

CVE-2026-47156: Improper Authentication

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

MantisBT - db_type File Read (CVE-2010-4348)

Reads arbitrary files via CVE-2010-4348 upgradeunattended.php dbtype LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2010-4348 upgradeunattended.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

MantisBT - db_type LFI Detection (CVE-2010-4348)

Detects CVE-2010-4348 via admin/upgradeunattended.php?dbtype=..%2f..%2fetc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4348 via admin/upgradeunattended.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

MantisBT 1.3.0 < 2.28.4 RCE (GHSA-v84x-qvhg-f36r)

The version of MantisBT installed on the remote host is 1.3.0 or later but prior to 2.28.4. It is, therefore, affected by a vulnerability: - A remote code execution vulnerability exists in the admin Manage Configuration feature admconfigset.php. When setting a configuration value with a non-strin...

MantisBT < 2.28.4 Multiple Vulnerabilities

The version of MantisBT installed on the remote host is prior to 2.28.4. It is, therefore, affected by multiple vulnerabilities: - A SQL injection vulnerability exists in core/historyapi.php. The historyorder configuration value is concatenated directly into a SQL ORDER BY clause without any...

MantisBT < 2.25.2 - Cross-Site Scripting Detection

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access Detection

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT through 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

MantisBT Login Panel - Detect

MantisBT login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MantisBT Login Panel - Detect', 'description':...