Mautic Mautic

• CVE-2026-3105 High 7.6 SQL Injection in Contact Activity API Sorting 0.3%
• CVE-2025-13828 Critical 9.0 Mautic user without privileged access to the Marketplace can install and uninstall composer packages 0.3%
• CVE-2025-13827 High 8.8 GrapesJsBuilder File Upload allows all file uploads 0.5%
• CVE-2025-9823 Medium 4.8 Reflected XSS in lead:addLeadTags - Quick Add 0.3%
• CVE-2025-9824 Medium 5.9 User Enumeration via Response Timing 0.3%
• CVE-2025-9822 Medium 5.5 Secret data extraction via elfinder 0.2%
• CVE-2025-9821 Low 2.7 SSRF via webhook function 0.3%
• CVE-2025-5256 Medium 5.4 Open Redirect vulnerability on user unlock path 0.2%
• CVE-2024-47055 Medium 4.3 Segment cloning doesn't have a proper permission check 0.3%
• CVE-2024-47057 Medium 5.3 User name enumeration possible due to response time difference on password reset form 0.3%
• CVE-2024-47056 Medium 5.1 Mautic does not shield .env files from web traffic 0.1%
• CVE-2025-5257 Medium 6.5 Predictable Page Indexing Might Lead to Sensitive Data Exposure 0.4%
• CVE-2022-25770 High 7.8 Insufficient authentication in upgrade flow 0.3%
• CVE-2024-47059 Medium 4.3 Users enumeration - weak password login 0.3%
• CVE-2021-27917 High 7.3 XSS in contact tracking and page hits report 0.3%
• CVE-2024-47050 Medium 5.4 XSS in contact/company tracking (no authentication) 0.3%
• CVE-2024-47058 Low 2.9 Cross-site Scripting (XSS) - stored (edit form HTML field) 0.2%
• CVE-2022-25768 High 7.0 Improper Access Control in UI upgrade process 0.3%
• CVE-2022-25777 Medium 6.5 Server-Side Request Forgery in Asset section 0.4%
• CVE-2022-25776 High 8.3 Sensitive Data Exposure due to inadequate user permission settings 0.4%
• CVE-2022-25775 Medium 6.6 SQL Injection in dynamic Reports 0.6%
• CVE-2022-25774 Medium 4.8 XSS in Notifications via saving Dashboards 0.4%
• CVE-2022-25769 High 7.2 Improper regex in htaccess file 0.5%
• CVE-2021-27916 High 8.1 Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) 0.8%
• CVE-2021-27915 High 7.6 XSS Cross-site Scripting Stored (XSS) - Description field 0.6%
• CVE-2024-3448 Medium 5.0 Improper Access Control Leads to Server-Side Request Forgery in Mautic 0.4%
• CVE-2024-2731 Medium 5.4 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic 0.4%
• CVE-2024-2730 Medium 5.3 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic 0.5%
• CVE-2022-25772 Critical 9.6 A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript 63.0%
• CVE-2021-27914 High 7.6 A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript 0.5%
• CVE-2021-27909 Medium 6.3 XSS vulnerability on password reset page 4.1%
• CVE-2021-27913 Low 3.5 Use of a Broken or Risky Cryptographic Algorithm 0.5%
• CVE-2021-27912 High 7.1 XSS vulnerability on asset view 0.6%
• CVE-2021-27911 High 8.3 XSS vulnerability on contacts view 0.6%
• CVE-2021-27910 High 8.2 Stored XSS vulnerability on Bounce Management Callback 0.7%
• CVE-2021-27908 Medium 5.8 In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the fr 0.3%