CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

databases/mantis2.26.0,1

Bug tracking system written in PHP

Maintainer
zab@zltech.eu
Packages
mantis-php82 2.26.0,1, mantis-php83 2.26.0,1, mantis-php84 2.26.0,1, mantis-php85 2.26.0,1, mantis-php86 2.26.0,1
Upstream
Higher version available: 2.28.4
CPE
mantisbt:mantisbt from the port
WWW
https://www.mantisbt.org/
Links
cgit · VuXML

Unaddressed (10) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 2.28.1 would fix 10 of 10 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 2.26.1 1 · 2.26.2 4 · 2.26.4 5 · 2.27.2 9 · 2.28.1 10
CVE-2026-308499.32026-03-23Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulner…
CVE-2025-477768.82025-11-04Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versio…
CVE-2024-238308.32024-02-20MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's accoun…
CVE-2024-340777.32024-05-14MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset ano…
CVE-2024-340816.62024-05-14MantisBT (Mantis Bug Tracker) is an open source issue tracker. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit,…
CVE-2025-465566.52025-11-04Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extreme…
CVE-2025-551555.42025-11-04Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system s…
CVE-2025-625205.32025-11-04Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to m…
CVE-2024-457925.32024-09-30Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other…
CVE-2024-340805.32024-05-14MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it …

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range this version has left.

Commits (84)

Felippe de Meirelles Motta (lippe) · 1.2.15
- Update to 1.2.15.

PR:		ports/179295
Submitted by:	Torsten Zuhlsdorff <foo@meisterderspiele.de>
Approved by:	maintainer timeout
c7f8a8bbd2
Bryan Drewery (bdrewery) · 1.2.14
- Update to 1.2.14

PR:		ports/171917
Submitted by:	Dan Langille <dan@langille.org> (maintainer)
ae5ae4b994
Wesley Shields (wxs) · 1.2.11
Update to 1.2.11.

PR:		ports/168983
Submitted by:	Dan Langille <dan@langille.org> (maintainer)
Security:	55587adb-b49d-11e1-8df1-0004aca374af
38eddf1bdb
Eitan Adler (eadler) · 1.2.7
- Update to 1.2.7

PR:		ports/160368
Submitted by:	gjb
Approved by:	dvl (maintainer), bapt (mentor)
Security:	CVE-2011-2938
d853d81edd
Beech Rintoul (beech) · 1.2.5
-Update to 1.2.5

-MantisBT 1.2.5 is a maintenance update for the stable 1.2.x branch.
 It is recommended that all MantisBT users (including those still using
 1.1.x or earlier versions) upgrade to this latest release.

-This release brings improved translations in many languages as well as
 numerous bug fixes across a range of MantisBT features.

-A full changelog for 1.2.5 can be found on the official site:
 http://www.mantisbt.org/bugs/changelog_page.php?version_id=113

PR:		ports/156763
Submitted by:	Rob Farmer <rfarmer@predatorlabs.net> (maintainer)
Approved by:	itetcu (mentor)(implicit)
72508b5b7b
Martin Wilke (miwi) · 1.2.4
- Update to 1.2.4

PR:		154047
Submitted by:	Marek Holienka <marekholienka@gmail.com>
Approved by:	maintainer
Feature safe:	yes
9ba08ce40c
Sunpoet Po-Chuan Hsieh (sunpoet) · 1.2.3_1
- Add missing PHP dependency: hash & session - Bump PORTREVISION - While I'm here, remove outdated no-op pre-everything::

PR:		ports/151267
Submitted by:	Frederic Praca <frederic.praca@freebsd-fr.org>
Approved by:	Dan Langille <dan@langille.org> (maintainer), pgollucci (mentor, implicit)
0a83a99405
Pav Lucistnik (pav) · 1.2.3
- Update to 1.2.3

PR:		ports/150580
Submitted by:	Dan Langille <dan@langille.org> (maintainer)
997ff03ecb
Wen Heping (wen) · 1.2.0
- Update to 1.2.0

PR:		ports/145281
Submitted by:	Wen Heping (myself)
Approved by:	mainatainer
c1a449a4ea
Dmitry Marakasov (amdmi3) · 1.1.8
- Switch SourceForge ports to the new File Release System: categories starting with D
075acacd24
Martin Wilke (miwi) · 1.1.8
- Update to 1.1.8

PR:		135887
Submitted by:	Hung-Yi Chen <gaod@hychen.org>
Approved by:	maintainer via irc
5b19a6d793
Martin Wilke (miwi) · 1.1.6
- Update to 1.1.6

PR:		129562
Submitted by:	Dan Langille <dan@langille.org> (maintainer)
12908c52ee
Martin Wilke (miwi) · 1.1.5
- Update to 1.1.5

PR:		129437
Submitted by:	Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Approved by:	maintainer
Security:	http://www.vuxml.org/freebsd/29255141-c3df-11dd-a721-0030843d3802.html
		http://www.vuxml.org/freebsd/00d6040a-b8e0-11dd-a578-0030843d3802.html
1f5c230b64
Martin Wilke (miwi) · 1.1.4
- Update to 1.1.4

PR:		128938
Submitted by:	artem.sidorenko@t-online.de (Artem Sidorenko)
Approved by:	maintainer via irc
056d9d6ef9
Edwin Groothuis (edwin) · 1.1.2
[MAINTAINER-UPDATE] databases/mantis upgrade to latest version

PR:		ports/126871
Submitted by:	Dan Langille <dan@langille.org>
8b97cd0df3
Felippe de Meirelles Motta (lippe) · 1.1.1_1
- bump PORTREVISION. - Use SF macro. - Add missing dependency.

PR:		ports/121819
Submitted by:	"Mark D. Foster" <mark@foster.cc>
Approved by:	araujo (mentor), Dan Langille <dan@langille.org> (maintainer)
6b3848c201
Martin Wilke (miwi) · 1.1.1
- Update to 1.1.1

PR:		119932
Submitted by:	Thomas Sandford <freebsduser@paradisegreen.co.uk>
Approved by:	maintainer (via irc)
d731481721
Martin Wilke (miwi) · 1.1.0
- Update to 1.1.0

PR:		119528
Submitted by:	Thomas Sandford <freebsduser@paradisegreen.co.uk>
Approved by:	maintainer
86b9ab4cd8
Pav Lucistnik (pav) · 1.0.7
- Allow Apache 2.0+

PR:		ports/114485
Submitted by:	Sture Ahlin <sture.ahlin@telia.com>
Approved by:	Dan Langille <dan@langille.org> (maintainer)
0e5c7267fd
Ion-Mihai Tetcu (itetcu) · 1.0.7
Fix typo.

Submitted by:	sat@
7c3b770b3b
Ion-Mihai Tetcu (itetcu) · 1.0.7
- Update to 1.0.7 [1] - depreciate own hackish MANTISDIR in favor od WWWDIR [2]

PR:		ports/113780
Submitted by:	Nils Vogels [1], itetcu@ (me) [2]
Approved by:	Dan Langille [1], [2] (on IRC)
a69b5082a3
Martin Wilke (miwi) · 1.0.6
- Update to 1.0.6

PR:		ports/106263
Submitted by:	TAKAHASHI Kaoru <kaoru@kaisei.org>
Approved by:	maintainer
defbc6da4d
Martin Wilke (miwi) · 1.0.5
- Update to 1.0.5

PR:		ports/101382
Submitted by:	Kian Mohageri <kian.mohageri(at)gmail.com>
Approved by:	krion (mentor), maintainer
3161ba348e
Pav Lucistnik (pav) · 1.0.3
- Update to 1.0.3

PR:		ports/98358
Submitted by:	Dan Langille <dan@langille.org> (maintainer)
33216e375b
Pav Lucistnik (pav) · 1.0.1
- Pass maintainership to Dan Langille - Update pkg-descr

PR:		ports/95201
Submitted by:	Dan Langille <dan@langille.org>
Suggested by:	gioria (maintainer)
c8e7bdc6df
Edwin Groothuis (edwin) · 1.0.1
[resurrect port] databases/mantis

I've been using mantis for some time, but didn't know it
        was in the tree.  I did some research and found that the
        bugs reported have been fixed.

        See my post to the vuxml list for details:

           http://docs.freebsd.org/cgi/mid.cgi?442DB5D7.30037.301FFEF

        One major change to the Makefile: do not overwrite the
        existing config_inc.php

PR:             ports/95189
Submitted by:   Dan Langille <dan@langille.org>
7c19b4ecfc
Mark Linimon (linimon)
Remove databases/mantis, it has been marked FORBIDDEN for more than 3 months.

Hat:	portmgr
abd81f8dcc
Edwin Groothuis (edwin) · 1.0.0a2
SHA256ify (manually done and checked)

Approved by:    krion@
44855e0b04
Simon L. B. Nielsen (simon) · 1.0.0a2
Mark FORBIDDEN due to remote file inclusion vulnerability (IE. effectively execute arbitrary PHP code).

Security:	http://vuxml.FreeBSD.org/82a41084-6ce7-11da-b90c-000e0c2e438a.html
Requested by:	remko
With hat:	secteam
965416509e
Pav Lucistnik (pav) · 1.0.0a2
- Update to 1.0.0a2

PR:		ports/81145
Submitted by:	John Oxley <john@yoafrica.com>
Approved by:	maintainer timeout (14 days)
ef1661457b
Pav Lucistnik (pav) · 0.18.2
- Update to 0.18.2

PR:		ports/64653
Submitted by:	gioria (maintainer)
b1fb147b0f
Mark Linimon (linimon) · 0.18.0
Update to 0.18.0 and fix problems with pkg-message and pkg-plist.

This includes about 18 months' worth of changes, which are extensive.
See ChangeLog.  But, note that the new distfile has been switched over
to DOS linebreaks, so the diffs are incredibly painful to read.  I
really wish authors would not do this.

PR:		ports/61368
Submitted by:	Nils Vogels <nivo@yuckfou.org>
Approved by:	gioria@FreeBSD.org (maintainer)
dc286c14c9
Edwin Groothuis (edwin) · 0.17.5
replace dependency on apache with USE_APACHE
ec56618aab
Edwin Groothuis (edwin) · 0.17.5
new ports: databases/mantis

Mantis is a web-based bugtracking system.

	It is written in the PHP scripting language and requires
	the MySQL database and a webserver. Mantis has been installed
	on Windows, MacOS, OS/2, and a variety of Unix operating
	systems. Any web browser should be able to function as a
	client. It is released under the terms of the GNU General
	Public License (GPL).

PR:		ports/46034
Submitted by:	Sebastien Gioria <gioria@FreeBSD.ORG>
f68fdc7175