Mautic vulnerabilities

Products

• Mautic 45
• Mautic/core 3

Newest

• acquia mautic SQL Injection in Contact Activity API Sorting CVE-2026-3105 Fix available 7.6 HighFebruary 24, 2026
• mautic Mautic user without privileged access to the Marketplace can install and uninstall composer packages CVE-2025-13828 Fix available 9.0 CriticalDecember 2, 2025
• mautic GrapesJsBuilder File Upload allows all file uploads CVE-2025-13827 Fix available 8.8 HighDecember 2, 2025
• mautic Reflected XSS in lead:addLeadTags - Quick Add CVE-2025-9823 Fix available 4.8 MediumSeptember 3, 2025
• mautic User Enumeration via Response Timing CVE-2025-9824 Fix available 5.9 MediumSeptember 3, 2025
• mautic Secret data extraction via elfinder CVE-2025-9822 Fix available 5.5 MediumSeptember 3, 2025
• mautic SSRF via webhook function CVE-2025-9821 Fix available 2.7 LowSeptember 3, 2025
• mautic docker mautic Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images CVE-2025-7381 5.3 MediumJuly 9, 2025
• mautic Open Redirect vulnerability on user unlock path CVE-2025-5256 Fix available 5.4 MediumMay 28, 2025
• acquia mautic Segment cloning doesn't have a proper permission check CVE-2024-47055 Fix available 4.3 MediumMay 28, 2025
• mautic User name enumeration possible due to response time difference on password reset form CVE-2024-47057 Fix available 5.3 MediumMay 28, 2025
• mautic Mautic does not shield .env files from web traffic CVE-2024-47056 Fix available 5.1 MediumMay 28, 2025
• mautic Predictable Page Indexing Might Lead to Sensitive Data Exposure CVE-2025-5257 Fix available 6.5 MediumMay 28, 2025
• acquia mautic, mautic mautic/core +1 more Remote Code Execution & File Deletion in Asset Uploads CVE-2024-47051 Public exploitFix available 9.1 CriticalFebruary 26, 2025
• acquia mautic, mautic mautic/core +1 more Improper Authorization in Reporting API CVE-2024-47053 Fix available 7.7 HighFebruary 26, 2025
• acquia mautic, mautic mautic/core +1 more Relative Path Traversal in assets file upload CVE-2022-25773 Fix available 4.3 MediumFebruary 26, 2025
• acquia mautic Insufficient authentication in upgrade flow CVE-2022-25770 Fix available 7.8 HighSeptember 18, 2024
• acquia mautic Users enumeration - weak password login CVE-2024-47059 Fix available 4.3 MediumSeptember 18, 2024
• acquia mautic XSS in contact tracking and page hits report CVE-2021-27917 Fix available 7.3 HighSeptember 18, 2024
• acquia mautic XSS in contact/company tracking (no authentication) CVE-2024-47050 Fix available 5.4 MediumSeptember 18, 2024
• acquia mautic Cross-site Scripting (XSS) - stored (edit form HTML field) CVE-2024-47058 Fix available 2.9 LowSeptember 18, 2024
• acquia mautic Improper Access Control in UI upgrade process CVE-2022-25768 Fix available 7.0 HighSeptember 18, 2024
• acquia mautic Server-Side Request Forgery in Asset section CVE-2022-25777 Fix available 6.5 MediumApril 12, 2024
• acquia mautic Sensitive Data Exposure due to inadequate user permission settings CVE-2022-25776 Fix available 8.3 HighApril 12, 2024
• acquia mautic SQL Injection in dynamic Reports CVE-2022-25775 Fix available 6.6 MediumApril 12, 2024
• acquia mautic Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) CVE-2021-27916 Fix available 8.1 HighApril 12, 2024
• acquia mautic XSS in Notifications via saving Dashboards CVE-2022-25774 Fix available 4.8 MediumApril 12, 2024
• acquia mautic XSS Cross-site Scripting Stored (XSS) - Description field CVE-2021-27915 Fix available 7.6 HighApril 11, 2024
• mautic Improper Access Control Leads to Server-Side Request Forgery in Mautic CVE-2024-3448 5.0 MediumApril 10, 2024
• acquia mautic Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVE-2024-2731 5.4 MediumApril 10, 2024
• mautic Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVE-2024-2730 5.3 MediumApril 10, 2024
• acquia mautic A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript CVE-2021-27914 7.6 HighJune 1, 2022
• acquia mautic Cross-site Scripting vulnerability in Mautic's tracking pixel functionality CVE-2022-25772 Fix available EPSS 63.0% 9.6 CriticalMay 25, 2022
• acquia mautic Improper regex in htaccess file CVE-2022-25769 Fix available 7.2 HighMarch 1, 2022
• acquia mautic XSS vulnerability on password reset page CVE-2021-27909 Fix available 6.3 MediumAugust 30, 2021
• acquia mautic Use of a Broken or Risky Cryptographic Algorithm CVE-2021-27913 Fix available 3.5 LowAugust 30, 2021
• acquia mautic XSS vulnerability on asset view CVE-2021-27912 Fix available 7.1 HighAugust 30, 2021
• acquia mautic XSS vulnerability on contacts view CVE-2021-27911 Fix available 8.3 HighAugust 30, 2021
• acquia mautic Stored XSS vulnerability on Bounce Management Callback CVE-2021-27910 Fix available 8.2 HighAugust 30, 2021
• acquia mautic Mautic vulnerable to secret data exfiltration via symfony parameters CVE-2021-27908 Fix available 5.8 MediumMarch 23, 2021
• mautic Mautic stored Cross-site Scripting (XSS) CVE-2020-35129 Fix available 9.0 CriticalJanuary 19, 2021
• mautic CSV Injection vulnerability with exported contact lists in Mautic CVE-2018-8092 Fix available 9.8 CriticalApril 18, 2018
• mautic XSS vulnerability in theme config file in Mautic CVE-2018-8071 Fix available 6.1 MediumApril 18, 2018
• mautic Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID CVE-2018-10189 Fix available 7.5 HighApril 17, 2018
• mautic Mautic Cross Site Scripting (XSS) vulnerability CVE-2017-1000506 Fix available 6.1 MediumFebruary 9, 2018
• acquia mautic Mautic users able to download any files from server using filemanager CVE-2017-1000490 Fix available 6.5 MediumJanuary 3, 2018
• acquia mautic Disabled users able to log in with third party SSO plugin CVE-2017-1000489 Fix available 8.1 HighJanuary 3, 2018
• acquia mautic Inline JS XSS vulnerability in Mautic CVE-2017-1000488 Fix available 6.1 MediumJanuary 3, 2018
• mautic Sensitive Cookie Without HttpOnly and Secure Flag CVE-2017-1000046 Fix available 7.5 HighJuly 13, 2017