CVE-2026-44655
MantisBT: Stored XSS on Move Attachments Admin Page
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
14th
Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. This vulnerability is fixed in 2.28.2.
| CWE | CWE-79 |
| Vendor | mantisbt |
| Product | mantisbt |
| Published | May 28, 2026 |
| Last Updated | May 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for mantisbt mantisbt
Be the first to know when new unknown vulnerabilities affecting mantisbt mantisbt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
mantisbt / mantisbt
>= 1.3.0, < 2.28.2