MA
Product
Mautic
36
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 22Low 1
Watch
Add Mautic to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-47051 | 9.9 | Feb 26 | Remote Code Execution & File Deletion in Asset Uploads Affected: before 5.2.3 |
| CVE-2020-35125 | 9.6 | Feb 9 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different… Affected: before 2.16.5; 3.0.0 before 3.2.4 |
| CVE-2020-35124 | 9.6 | Jan 28 | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of… Affected: before 3.2.4 |
| CVE-2022-25769 | 9.1 | Sep 18 | Improper regex in htaccess file Affected: before 3.3.5; 4.0.0 before 4.2.0 |
| CVE-2021-27915 | 9.0 | Sep 17 | XSS Cross-site Scripting Stored (XSS) - Description field Affected: 1.0.0 before 4.4.12; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more |
| CVE-2020-35128 | 9.0 | Jan 19 | Mautic before 3.2.4 is affected by stored XSS Affected: 2.0.0 before 2.16.5; 3.2.0 before 3.2.4 |
| CVE-2026-3105 | 8.8 | Feb 24 | SQL Injection in Contact Activity API Sorting Affected: 2.10.0 before 4.4.19; 5.0.0 before 5.2.10; 6.0.0 before 6.0.8; 7.0.0 before 7.0.1 |
| CVE-2017-8874 | 8.8 | May 10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email… Affected: 1.4.1 |
| CVE-2021-27916 | 8.1 | Sep 17 | Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) Affected: 3.3.0 before 4.4.12; 5.0.0 before 5.0.4 |
| CVE-2017-1000489 | 8.1 | Jan 3 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address Affected: 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.2.0; 2.2.1; +16 more |
| CVE-2024-47053 | 7.7 | Feb 26 | Improper Authorization in Reporting API Affected: 1.0.1 before 5.2.3 |
| CVE-2022-25770 | 7.5 | Sep 18 | Insufficient authentication in upgrade flow Affected: 1.0.1 before 4.4.13; 5.0.0 before 5.1.1; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more |
| CVE-2022-25775 | 7.2 | Sep 18 | SQL Injection in dynamic Reports Affected: 2.14.1 before 4.4.12; 5.0.0 before 5.0.4 |
| CVE-2022-25768 | 6.5 | Sep 18 | Improper Access Control in UI upgrade process Affected: 1.1.3 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2022-25777 | 6.5 | Sep 18 | Server-Side Request Forgery in Asset section Affected: 1.0.1 before 4.4.12; 5.0.0 before 5.0.4; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +2 more |
| CVE-2022-25776 | 6.5 | Sep 18 | Sensitive Data Exposure due to inadequate user permission settings Affected: 1.0.2 before 4.4.12; 5.0.0 before 5.0.4 |
| CVE-2017-1000490 | 6.5 | Jan 3 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the… Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.1.0; +34 more |
| CVE-2024-47050 | 6.1 | Sep 18 | XSS in contact/company tracking (no authentication) Affected: 2.6.0 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2022-25772 | 6.1 | Jun 20 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript Affected: before 4.3.0 |
| CVE-2021-27911 | 6.1 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-27910 | 6.1 | Aug 30 | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-27909 | 6.1 | Aug 30 | For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2018-11200 | 6.1 | Sep 20 | An issue was discovered in Mautic 2.13.1 Affected: 2.13.1 |
| CVE-2018-11198 | 6.1 | Sep 6 | An issue was discovered in Mautic 2.13.1 Affected: 2.13.1 |
| CVE-2017-1000488 | 6.1 | Jan 3 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form Affected: 2.1.0; 2.1.1; 2.2.0; 2.2.1; 2.3.0; 2.4.0; +14 more |
| CVE-2022-25773 | 5.4 | Feb 26 | Relative Path Traversal in assets file upload Affected: before 5.2.3 |
| CVE-2021-27917 | 5.4 | Sep 18 | XSS in contact tracking and page hits report Affected: after 1.0.0 before 4.4.13; 5.0.0 before 5.1.1; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +2 more |
| CVE-2022-25774 | 5.4 | Sep 18 | XSS in Notifications via saving Dashboards Affected: before 4.4.12 |
| CVE-2024-2731 | 5.4 | Apr 10 | Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic Affected: through 4.4.9 |
| CVE-2021-27912 | 5.4 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2024-47058 | 4.8 | Sep 18 | Cross-site Scripting (XSS) - stored (edit form HTML field) Affected: 1.0.0 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2021-27914 | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript Affected: before 4.3.0 |
| CVE-2021-27908 | 4.4 | Mar 23 | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter… Affected: before 3.3.2 |
| CVE-2024-47055 | 4.3 | May 28 | Segment cloning doesn't have a proper permission check Affected: 5.0.0 before 5.2.6; 6.0.0 before 6.0.2 |
| CVE-2024-47059 | 4.3 | Sep 18 | Users enumeration - weak password login Affected: 5.1.0 |
| CVE-2021-27913 | 3.5 | Aug 30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
Showing 36