MA
Product
Mautic
36
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 22Low 1
Watch
Add Mautic to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-25768 | 6.5 | Sep 18 | Improper Access Control in UI upgrade process Affected: 1.1.3 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2022-25777 | 6.5 | Sep 18 | Server-Side Request Forgery in Asset section Affected: 1.0.1 before 4.4.12; 5.0.0 before 5.0.4; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +2 more |
| CVE-2022-25776 | 6.5 | Sep 18 | Sensitive Data Exposure due to inadequate user permission settings Affected: 1.0.2 before 4.4.12; 5.0.0 before 5.0.4 |
| CVE-2017-1000490 | 6.5 | Jan 3 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the… Affected: 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.1.0; +34 more |
| CVE-2024-47050 | 6.1 | Sep 18 | XSS in contact/company tracking (no authentication) Affected: 2.6.0 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2022-25772 | 6.1 | Jun 20 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript Affected: before 4.3.0 |
| CVE-2021-27911 | 6.1 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-27910 | 6.1 | Aug 30 | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-27909 | 6.1 | Aug 30 | For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2018-11200 | 6.1 | Sep 20 | An issue was discovered in Mautic 2.13.1 Affected: 2.13.1 |
| CVE-2018-11198 | 6.1 | Sep 6 | An issue was discovered in Mautic 2.13.1 Affected: 2.13.1 |
| CVE-2017-1000488 | 6.1 | Jan 3 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form Affected: 2.1.0; 2.1.1; 2.2.0; 2.2.1; 2.3.0; 2.4.0; +14 more |
| CVE-2022-25773 | 5.4 | Feb 26 | Relative Path Traversal in assets file upload Affected: before 5.2.3 |
| CVE-2021-27917 | 5.4 | Sep 18 | XSS in contact tracking and page hits report Affected: after 1.0.0 before 4.4.13; 5.0.0 before 5.1.1; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +2 more |
| CVE-2022-25774 | 5.4 | Sep 18 | XSS in Notifications via saving Dashboards Affected: before 4.4.12 |
| CVE-2024-2731 | 5.4 | Apr 10 | Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic Affected: through 4.4.9 |
| CVE-2021-27912 | 5.4 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a… Affected: before 3.3.4; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2024-47058 | 4.8 | Sep 18 | Cross-site Scripting (XSS) - stored (edit form HTML field) Affected: 1.0.0 before 4.4.13; 5.0.0 before 5.1.1 |
| CVE-2021-27914 | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript Affected: before 4.3.0 |
| CVE-2021-27908 | 4.4 | Mar 23 | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter… Affected: before 3.3.2 |
| CVE-2024-47055 | 4.3 | May 28 | Segment cloning doesn't have a proper permission check Affected: 5.0.0 before 5.2.6; 6.0.0 before 6.0.2 |
| CVE-2024-47059 | 4.3 | Sep 18 | Users enumeration - weak password login Affected: 5.1.0 |
Showing 22