CVE-2018-11200
XSS vulnerability in company name field in Mautic
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- Record
CVE-2018-11200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- Record
CVE-2018-11200- Updated
- 2026-11-02
EUVDEUVD-2021-0499 No score
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- Record
EUVD-2021-0499- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9hx7-rg7w-xm79
XSS vulnerability in company name field in Mautic
Impact
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
Patches
Update to 2.14.0 or later.
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-9hx7-rg7w-xm79- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- Record
CVE-2018-11200- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-9hx7-rg7w-xm79
XSS vulnerability in company name field in Mautic
Impact
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
Patches
Update to 2.14.0 or later.
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-9hx7-rg7w-xm79- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mautic/corePackagist |
before 2.11.0 | 2.11.0 |
mautic/corePackagist |
before 2.14.0, plus listed versions 1.0.01.0.0-beta1.0.0-beta21.0.0-beta31.0.0-beta4 Show 45 moreShow less1.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.2.01.2.0-beta11.2.11.2.21.2.31.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.0-beta2.2.02.2.12.3.0 |
2.14.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11200 is a medium vulnerability (CVSS 6.1) in Acquia Mautic, published September 20, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in mautic/core 2.11.0.
References
Left out here: 14 versions. The JSON record has them.