Mantis is an open-source bug-tracking and issue-management platform that has accumulated a substantial vulnerability footprint despite its narrow product scope, reflecting its long deployment history and exposure as a web-facing application. The platform's disclosures center on a recurring set of web-application weakness classes: cross-site scripting, code injection, improper authentication, and information-disclosure flaws that are characteristic of server-side request handling and access-control logic in collaborative web tools. Public exploit code has frequently become available for Mantis vulnerabilities, making disclosures from this project particularly actionable for defenders managing exposed instances. Organizations running this platform should prioritize timely patching and network segmentation, particularly for internet-reachable deployments; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mantis over time
Signals from CVEs in this vendor scope (46 CVEs).
46 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-4687HIGH manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create | Oct 22, 2008 | 9.0 | 79 | NO | YES |
CVE-2006-0147HIGH Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) | Jan 9, 2006 | 7.5 | 36 | NO | YES |
CVE-2002-1113HIGH summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location o | Oct 4, 2002 | 7.5 | 35 | NO | YES |
CVE-2006-0146HIGH The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MA | Jan 9, 2006 | 7.5 | 34 | NO | YES |
CVE-2008-3332MEDIUM Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter. | Jul 27, 2008 | 6.5 | 31 | NO | YES |
CVE-2002-1110HIGH Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform unauthoriz | Oct 4, 2002 | 10.0 | 30 | NO | NO |
CVE-2004-1731MEDIUM signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address. | Aug 20, 2004 | 5.0 | 28 | NO | YES |
CVE-2006-0665HIGH Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this informat | Feb 13, 2006 | 10.0 | 25 | NO | NO |
CVE-2006-6515HIGH Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly rel | Dec 14, 2006 | 10.0 | 24 | NO | NO |
CVE-2008-3333HIGH Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user | Jul 27, 2008 | 7.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (46 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mantis.
Media articles that mention a CVE ID that affects a product developed by Mantis — matched by CVE ID, not by vendor name.