Mautic

Latest CVEs · RSS

• CVE-2026-9811 2026-05-29 · CVSS 5.4
  A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects
• CVE-2026-9809 2026-05-29 · CVSS 7.6
  A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative deta
• CVE-2026-9808 2026-05-29 · CVSS 7.1
  An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-sc
• CVE-2026-9559 2026-05-29 · CVSS 9.9
  A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the vali
• CVE-2026-9558 2026-05-29 · CVSS 9.9
  A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict
• CVE-2026-9557 2026-05-29 · CVSS 6.4
  A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated us
• CVE-2026-4776 2026-05-29 · CVSS 7.1
  An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an aut
• CVE-2026-3105 2026-02-24 · CVSS 7.6
  SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query con
• CVE-2025-13828 2025-12-02 · CVSS 9.0
  SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enab
• CVE-2025-13827 2025-12-02 · CVSS 8.8
  Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is n
• CVE-2025-9823 2025-09-03 · CVSS 4.8
  SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs becau
• CVE-2025-9824 2025-09-03 · CVSS 5.9
  ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after whic
• CVE-2025-9822 2025-09-03 · CVSS 5.5
  SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn ad
• CVE-2025-9821 2025-09-03 · CVSS 2.7
  SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also di
• CVE-2025-7381 2025-07-09 · CVSS 5.3
  ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By head
• CVE-2025-5256 2025-05-28 · CVSS 5.4
  SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to re
• CVE-2024-47055 2025-05-28 · CVSS 4.3
  SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user
• CVE-2024-47057 2025-05-28 · CVSS 5.3
  SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by
• CVE-2024-47056 2025-05-28 · CVSS 5.1
  SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This ex
• CVE-2025-5257 2025-05-28 · CVSS 6.5
  SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially ind
• CVE-2024-47051 2025-02-26 · CVSS 9.1
  This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated
• CVE-2024-47053 2025-02-26 · CVSS 7.7
  This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensit
• CVE-2022-25773 2025-02-26 · CVSS 4.3
  This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitation
• CVE-2022-25770 2024-09-18 · CVSS 7.8
  Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. Thi
• CVE-2024-47059 2024-09-18 · CVSS 4.3
  When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an inc