CVE-2026-34754

CAPTCHA bypass vulnerability in MantisBT before version 1.2.19.

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, allowing remote attackers to obtain database credentials via the install parameter with the value 4.

The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.

Multiple SQL injection vulnerabilities in MantisBT before version 1.2.18 in view_all_bug_page.php allow remote attackers to execute arbitrary SQL commands via the sort or dir parameter to view_all_set.php.

SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter.

Multiple SQL injection vulnerabilities in MantisBT before version 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in various API functions.

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default installations because self-registration is enabled by default.

Mantis Bug Tracker (MantisBT) prior to version 2.28.2 contains a vulnerability that allows code execution by an attacker. By using the show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can upload a crafted XHTML attachment referencing a JavaScript attachment.

In Mantis Bug Tracker (MantisBT) versions 1.3.0 through 2.28.1, an unescaped Project Name allows an attacker with manager or administrator privileges to inject HTML on the Move Attachments admin page. This vulnerability is fixed in version 2.28.2.