MA
Product
Mautic
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 8Medium 23Low 1
Watch
Add Mautic to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-5257 | 6.5 | May 28 | Predictable Page Indexing Might Lead to Sensitive Data Exposure Affected: > 4.0 before < 6.0.2, <5.4.6, <4.4.16 |
| CVE-2022-25768 | 6.5 | Sep 18 | Improper Access Control in UI upgrade process Affected: >= 1.1.3 before < 4.4.13; >= 5.0.0 before < 5.1.1 |
| CVE-2022-25777 | 6.5 | Sep 18 | Server-Side Request Forgery in Asset section Affected: >= 1.0.0-beta4 before < 4.4.12; > 5.0.0 before < 5.0.4 |
| CVE-2022-25776 | 6.5 | Sep 18 | Sensitive Data Exposure due to inadequate user permission settings Affected: >= 1.0.2 before < 4.4.12; >5.0.0 before < 5.0.4 |
| CVE-2017-1000490 | 6.5 | Jan 3 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the… Affected: 1.0.0; 1.2.0; 2.9.0; 2.9.2; 2.10.0; 2.11.0 |
| CVE-2024-47050 | 6.1 | Sep 18 | XSS in contact/company tracking (no authentication) Affected: >= 2.6.0 before < 4.4.13; > 5.0.0 before < 5.1.1 |
| CVE-2018-8071 | 6.1 | Apr 18 | Mautic before v2.13.0 has stored XSS via a theme config file Affected: before 2.13.0 |
| CVE-2017-1000506 | 6.1 | Feb 9 | Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code Affected: through 2.11.0 |
| CVE-2017-1000488 | 6.1 | Jan 3 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form Affected: 2.9.0; 2.9.2; 2.10.0; 2.11.0 |
| CVE-2025-9824 | 5.9 | Sep 3 | User Enumeration via Response Timing Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5 |
| CVE-2025-9822 | 5.5 | Sep 3 | Secret data extraction via elfinder Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5 |
| CVE-2025-5256 | 5.4 | May 28 | Open Redirect vulnerability on user unlock path Affected: > 1.0.0 before < 6.0.2, < 5.2.6, < 4.4.16 |
| CVE-2021-27917 | 5.4 | Sep 18 | XSS in contact tracking and page hits report Affected: >= 1.0.0-beta4 before < 4.4.13; >= 5.0.0 before < 5.1.1 |
| CVE-2022-25774 | 5.4 | Sep 18 | XSS in Notifications via saving Dashboards Affected: < 4.4.12 |
| CVE-2024-2731 | 5.4 | Apr 10 | Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic Affected: through 4.4.9 |
| CVE-2024-47057 | 5.3 | May 28 | User name enumeration possible due to response time difference on password reset form Affected: > 1.0 before < 6.0.2, < 5.2.6, < 4.4.16 |
| CVE-2024-2730 | 5.3 | Apr 10 | Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic Affected: through 4.4.9 |
| CVE-2024-47056 | 5.1 | May 28 | Mautic does not shield .env files from web traffic Affected: > 4.4.0 before < 6.0.2, < 5.2.6, <4.4.16 |
| CVE-2024-3448 | 5.0 | Apr 10 | Improper Access Control Leads to Server-Side Request Forgery in Mautic Affected: through 4.4.9 |
| CVE-2025-9823 | 4.8 | Sep 3 | Reflected XSS in lead:addLeadTags - Quick Add Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5 |
| CVE-2024-47058 | 4.8 | Sep 18 | Cross-site Scripting (XSS) - stored (edit form HTML field) Affected: >= 1.0.0 before < 4.4.13; >= 5.0.0 before < 5.1.1 |
| CVE-2024-47055 | 4.3 | May 28 | Segment cloning doesn't have a proper permission check Affected: > 5.0.0 before < 5.2.6, < 6.0.2 |
| CVE-2024-47059 | 4.3 | Sep 18 | Users enumeration - weak password login Affected: >= 5.1.0 before < 5.1.1 |
Showing 23