CVE-2025-46556
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Nov 4, 2025
CISA due date
—
The record
MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | 0 | 2.27.2 |
Related vulnerabilities
- GHSA-r3jf-hm7q-qfw5 MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length Same vulnerability
- CVE-2025-62520 MantisBT unauthorized disclosure of private project column configuration Also affects mantisbt/mantisbt
- CVE-2025-55155 MantisBT: Authentication bypass for some passwords due to PHP type juggling Also affects mantisbt/mantisbt
- CVE-2025-47776 MantisBT: Authentication bypass for some passwords due to PHP type juggling Also affects mantisbt/mantisbt
- GHSA-g582-8vwr-68h2 MantisBT unauthorized disclosure of private project column configuration Also affects mantisbt/mantisbt
- GHSA-q747-c74m-69pr MantisBT lacks verification when changing a user's email address Also affects mantisbt/mantisbt
- GHSA-4v8w-gg5j-ph37 MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling Also affects mantisbt/mantisbt
- CVE-2017-7615 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access… Also affects mantisbt/mantisbt