Login Request a demo
MA
Product
Mautic
by Mautic · last CVE Feb 24, 2026
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities21In the news0Timeline
Severity mix
Critical 3High 5Medium 12Low 1
Severity
All severities21Critical3High5Medium12Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mautic to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-5257
6.5
0%
May 28
Predictable Page Indexing Might Lead to Sensitive Data Exposure
Affected: > 4.0 before < 6.0.2, <5.4.6, <4.4.16
CVE-2017-1000490
6.5
1%
Jan 3
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the…
Affected: 1.0.0; 1.2.0; 2.9.0; 2.9.2; 2.10.0; 2.11.0
CVE-2018-8071
6.1
1%
Apr 18
Mautic before v2.13.0 has stored XSS via a theme config file
Affected: before 2.13.0
CVE-2017-1000506
6.1
1%
Feb 9
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code
Affected: through 2.11.0
CVE-2017-1000488
6.1
1%
Jan 3
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form
Affected: 2.9.0; 2.9.2; 2.10.0; 2.11.0
CVE-2025-9824
5.9
0%
Sep 3
User Enumeration via Response Timing
Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5
CVE-2025-9822
5.5
0%
Sep 3
Secret data extraction via elfinder
Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5
CVE-2025-5256
5.4
0%
May 28
Open Redirect vulnerability on user unlock path
Affected: > 1.0.0 before < 6.0.2, < 5.2.6, < 4.4.16
CVE-2024-47057
5.3
0%
May 28
User name enumeration possible due to response time difference on password reset form
Affected: > 1.0 before < 6.0.2, < 5.2.6, < 4.4.16
CVE-2024-47056
5.1
0%
May 28
Mautic does not shield .env files from web traffic
Affected: > 4.4.0 before < 6.0.2, < 5.2.6, <4.4.16
CVE-2025-9823
4.8
0%
Sep 3
Reflected XSS in lead:addLeadTags - Quick Add
Affected: >= 4.4.0 before < 4.4.17; >= 5.0.0-alpha before < 5.2.8; >= 6.0.0-alpha before < 6.0.5
CVE-2024-47055
4.3
0%
May 28
Segment cloning doesn't have a proper permission check
Affected: > 5.0.0 before < 5.2.6, < 6.0.2
Showing 12