Mautic

Products

Exploited and recent CVEs

• CVE-2026-3105 High 7.6 SQL Injection in Contact Activity API Sorting 0.3%
• CVE-2025-13828 Critical 9.0 Mautic user without privileged access to the Marketplace can install and uninstall composer packages 0.3%
• CVE-2025-13827 High 8.8 GrapesJsBuilder File Upload allows all file uploads 0.5%
• CVE-2025-9823 Medium 4.8 Reflected XSS in lead:addLeadTags - Quick Add 0.3%
• CVE-2025-9824 Medium 5.9 User Enumeration via Response Timing 0.3%
• CVE-2025-9822 Medium 5.5 Secret data extraction via elfinder 0.2%
• CVE-2025-9821 Low 2.7 SSRF via webhook function 0.3%
• CVE-2025-7381 Medium 5.3 Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images 0.3%
• CVE-2025-5256 Medium 5.4 Open Redirect vulnerability on user unlock path 0.2%
• CVE-2024-47055 Medium 4.3 Segment cloning doesn't have a proper permission check 0.3%
• CVE-2024-47057 Medium 5.3 User name enumeration possible due to response time difference on password reset form 0.3%
• CVE-2024-47056 Medium 5.1 Mautic does not shield .env files from web traffic 0.1%
• CVE-2025-5257 Medium 6.5 Predictable Page Indexing Might Lead to Sensitive Data Exposure 0.4%
• CVE-2024-47051 Critical 9.1 Remote Code Execution & File Deletion in Asset Uploads 1.8%
• CVE-2024-47053 High 7.7 Improper Authorization in Reporting API 0.7%
• CVE-2022-25773 Medium 4.3 Relative Path Traversal in assets file upload 0.6%
• CVE-2022-25770 High 7.8 Insufficient authentication in upgrade flow 0.3%
• CVE-2024-47059 Medium 4.3 Users enumeration - weak password login 0.3%
• CVE-2021-27917 High 7.3 XSS in contact tracking and page hits report 0.3%
• CVE-2024-47050 Medium 5.4 XSS in contact/company tracking (no authentication) 0.3%
• CVE-2024-47058 Low 2.9 Cross-site Scripting (XSS) - stored (edit form HTML field) 0.2%
• CVE-2022-25768 High 7.0 Improper Access Control in UI upgrade process 0.3%
• CVE-2022-25777 Medium 6.5 Server-Side Request Forgery in Asset section 0.4%
• CVE-2022-25776 High 8.3 Sensitive Data Exposure due to inadequate user permission settings 0.4%
• CVE-2022-25775 Medium 6.6 SQL Injection in dynamic Reports 0.6%
• CVE-2022-25774 Medium 4.8 XSS in Notifications via saving Dashboards 0.4%
• CVE-2022-25769 High 7.2 Improper regex in htaccess file 0.5%
• CVE-2021-27916 High 8.1 Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) 0.8%
• CVE-2021-27915 High 7.6 XSS Cross-site Scripting Stored (XSS) - Description field 0.6%
• CVE-2024-3448 Medium 5.0 Improper Access Control Leads to Server-Side Request Forgery in Mautic 0.4%