Acquia Mautic vulnerabilities

• acquia mautic SQL Injection in Contact Activity API Sorting CVE-2026-3105 Fix available 7.6 HighFebruary 24, 2026
• acquia mautic Segment cloning doesn't have a proper permission check CVE-2024-47055 Fix available 4.3 MediumMay 28, 2025
• acquia mautic, mautic mautic/core +1 more Remote Code Execution & File Deletion in Asset Uploads CVE-2024-47051 Public exploitFix available 9.1 CriticalFebruary 26, 2025
• acquia mautic, mautic mautic/core +1 more Improper Authorization in Reporting API CVE-2024-47053 Fix available 7.7 HighFebruary 26, 2025
• acquia mautic, mautic mautic/core +1 more Relative Path Traversal in assets file upload CVE-2022-25773 Fix available 4.3 MediumFebruary 26, 2025
• acquia mautic Insufficient authentication in upgrade flow CVE-2022-25770 Fix available 7.8 HighSeptember 18, 2024
• acquia mautic Users enumeration - weak password login CVE-2024-47059 Fix available 4.3 MediumSeptember 18, 2024
• acquia mautic XSS in contact tracking and page hits report CVE-2021-27917 Fix available 7.3 HighSeptember 18, 2024
• acquia mautic XSS in contact/company tracking (no authentication) CVE-2024-47050 Fix available 5.4 MediumSeptember 18, 2024
• acquia mautic Cross-site Scripting (XSS) - stored (edit form HTML field) CVE-2024-47058 Fix available 2.9 LowSeptember 18, 2024
• acquia mautic Improper Access Control in UI upgrade process CVE-2022-25768 Fix available 7.0 HighSeptember 18, 2024
• acquia mautic Server-Side Request Forgery in Asset section CVE-2022-25777 Fix available 6.5 MediumApril 12, 2024
• acquia mautic Sensitive Data Exposure due to inadequate user permission settings CVE-2022-25776 Fix available 8.3 HighApril 12, 2024
• acquia mautic SQL Injection in dynamic Reports CVE-2022-25775 Fix available 6.6 MediumApril 12, 2024
• acquia mautic Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) CVE-2021-27916 Fix available 8.1 HighApril 12, 2024
• acquia mautic XSS in Notifications via saving Dashboards CVE-2022-25774 Fix available 4.8 MediumApril 12, 2024
• acquia mautic XSS Cross-site Scripting Stored (XSS) - Description field CVE-2021-27915 Fix available 7.6 HighApril 11, 2024
• acquia mautic Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVE-2024-2731 5.4 MediumApril 10, 2024
• acquia mautic A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript CVE-2021-27914 7.6 HighJune 1, 2022
• acquia mautic Cross-site Scripting vulnerability in Mautic's tracking pixel functionality CVE-2022-25772 Fix available EPSS 63.0% 9.6 CriticalMay 25, 2022
• acquia mautic Improper regex in htaccess file CVE-2022-25769 Fix available 7.2 HighMarch 1, 2022
• acquia mautic XSS vulnerability on password reset page CVE-2021-27909 Fix available 6.3 MediumAugust 30, 2021
• acquia mautic Use of a Broken or Risky Cryptographic Algorithm CVE-2021-27913 Fix available 3.5 LowAugust 30, 2021
• acquia mautic XSS vulnerability on asset view CVE-2021-27912 Fix available 7.1 HighAugust 30, 2021
• acquia mautic XSS vulnerability on contacts view CVE-2021-27911 Fix available 8.3 HighAugust 30, 2021
• acquia mautic Stored XSS vulnerability on Bounce Management Callback CVE-2021-27910 Fix available 8.2 HighAugust 30, 2021
• acquia mautic Mautic vulnerable to secret data exfiltration via symfony parameters CVE-2021-27908 Fix available 5.8 MediumMarch 23, 2021
• acquia mautic Mautic is vulnerable to XSS vulnerability CVE-2020-35125 Fix available 9.6 CriticalFebruary 9, 2021
• acquia mautic XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic CVE-2020-35124 Fix available 9.6 CriticalJanuary 19, 2021
• acquia mautic Mautic stored Cross-site Scripting (XSS) CVE-2020-35128 Fix available 9.0 CriticalJanuary 19, 2021
• acquia mautic XSS vulnerability in company name field in Mautic CVE-2018-11200 Fix available 6.1 MediumSeptember 20, 2019
• acquia mautic XSS vulnerability in Author URL of themes in Mautic CVE-2018-11198 Fix available 6.1 MediumSeptember 6, 2019
• acquia mautic Mautic users able to download any files from server using filemanager CVE-2017-1000490 Fix available 6.5 MediumJanuary 3, 2018
• acquia mautic Disabled users able to log in with third party SSO plugin CVE-2017-1000489 Fix available 8.1 HighJanuary 3, 2018
• acquia mautic Inline JS XSS vulnerability in Mautic CVE-2017-1000488 Fix available 6.1 MediumJanuary 3, 2018
• acquia mautic Mautic Cross-Site Request Forgery (CSRF) CVE-2017-8874 8.8 HighMay 10, 2017