MantisBT < 2.28.1 - SOAP API Authentication Bypass

Mantis Bug Tracker 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. id:...

MantisBT < 2.25.2 - Cross-Site Scripting

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. id: CVE-2022-28508 info: name: MantisBT 2.25.2 -...

CVE-2026-30849-PoC

CVE-2026-30849.ts — usage This TypeScript script performs a check and an exploit for MantisBT via SOAP. Prerequisites Node.js installed Dependencies installed: npm install Command ts-node CVE-2026-30849.ts check --url ts-node CVE-2026-30849.ts exploit --url npx ts-node .\CVE-2026-30849.ts check...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

VulnCheck KEV: CVE-2026-30849

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

VulnCheck KEV: CVE-2017-7615

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

EUVD-2026-75087

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user holding a valid cookie_string (obtainable from the MANTIS_STRING_COOKIE browser cookie after login) can authenticate as any other user by supplying that cookie_stri...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156 MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

CVE-2026-47156: Improper Authentication

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mcichecklogin function. Any user knowing any valid cookiestring can authenticate as any other user knowing their username, including the administrator, without knowing th...

MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

MantisBT - db_type LFI Detection (CVE-2010-4348)

Detects CVE-2010-4348 via admin/upgradeunattended.php?dbtype=..%2f..%2fetc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4348 via admin/upgradeunattended.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

MantisBT - db_type File Read (CVE-2010-4348)

Reads arbitrary files via CVE-2010-4348 upgradeunattended.php dbtype LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2010-4348 upgradeunattended.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

MantisBT < 2.28.4 Multiple Vulnerabilities

The version of MantisBT installed on the remote host is prior to 2.28.4. It is, therefore, affected by multiple vulnerabilities: - A SQL injection vulnerability exists in core/historyapi.php. The historyorder configuration value is concatenated directly into a SQL ORDER BY clause without any...

MantisBT 1.3.0 < 2.28.4 RCE (GHSA-v84x-qvhg-f36r)

The version of MantisBT installed on the remote host is 1.3.0 or later but prior to 2.28.4. It is, therefore, affected by a vulnerability: - A remote code execution vulnerability exists in the admin Manage Configuration feature admconfigset.php. When setting a configuration value with a non-strin...

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access Detection

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT through 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...