AC
Vendor
Acquia
43
CVEs
0
On KEV
0
New 30D
Products
MA9.9
Mautic
Acquia
35 CVEs0 on KEV0 new
CO–
Commons
Acquia
3 CVEs0 on KEV0 new
DA7.5
Dam
Acquia
2 CVEs0 on KEV0 new
AC8.1
Acquia Content Hub
Acquia
1 CVEs0 on KEV0 new
CG–
Commons Group
Acquia
1 CVEs0 on KEV0 new
MO7.5
Mollom
Acquia
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-3105 | MA Mautic Acquia | 8.8 | Feb 24 | SQL Injection in Contact Activity API Sorting |
| CVE-2025-14472 | AC Acquia Content Hub Acquia | 8.1 | Jan 28 | Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125 |
| CVE-2025-9954 | DA Dam Acquia | 7.5 | Oct 29 | Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105 |
| CVE-2024-47055 | MA Mautic Acquia | 4.3 | May 28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality |
| CVE-2024-47053 | MA Mautic Acquia | 7.7 | Feb 26 | This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation |
| CVE-2024-47051 | MA Mautic Acquia | 9.9 | Feb 26 | This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3 |
| CVE-2022-25773 | MA Mautic Acquia | 5.4 | Feb 26 | This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server |
| CVE-2024-13261 | DA Dam Acquia | 3.5 | Jan 9 | Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025 |
| CVE-2024-47059 | MA Mautic Acquia | 4.3 | Sep 18 | When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak |
| CVE-2022-25770 | MA Mautic Acquia | 7.5 | Sep 18 | Mautic allows you to update the application via an upgrade script |
| CVE-2021-27917 | MA Mautic Acquia | 5.4 | Sep 18 | Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report |
| CVE-2024-47058 | MA Mautic Acquia | 4.8 | Sep 18 | With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed |
| CVE-2024-47050 | MA Mautic Acquia | 6.1 | Sep 18 | Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable |
| CVE-2022-25768 | MA Mautic Acquia | 6.5 | Sep 18 | The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks |
| CVE-2022-25777 | MA Mautic Acquia | 6.5 | Sep 18 | Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery… |
| CVE-2022-25776 | MA Mautic Acquia | 6.5 | Sep 18 | Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing |
| CVE-2022-25775 | MA Mautic Acquia | 7.2 | Sep 18 | Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle |
| CVE-2022-25774 | MA Mautic Acquia | 5.4 | Sep 18 | Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic |
| CVE-2022-25769 | MA Mautic Acquia | 9.1 | Sep 18 | ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application |
| CVE-2021-27916 | MA Mautic Acquia | 8.1 | Sep 17 | Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion |
| CVE-2021-27915 | MA Mautic Acquia | 9.0 | Sep 17 | Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the… |
| CVE-2022-25772 | MA Mautic Acquia | 6.1 | Jun 20 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript |
| CVE-2021-27914 | MA Mautic Acquia | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript |
| CVE-2021-27913 | MA Mautic Acquia | 3.5 | Aug 30 | The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of… |
| CVE-2021-27912 | MA Mautic Acquia | 5.4 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a… |
| CVE-2021-27911 | MA Mautic Acquia | 6.1 | Aug 30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then… |
| CVE-2021-27910 | MA Mautic Acquia | 6.1 | Aug 30 | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function |
| CVE-2021-27909 | MA Mautic Acquia | 6.1 | Aug 30 | For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker… |
| CVE-2021-27908 | MA Mautic Acquia | 4.4 | Mar 23 | In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter… |
| CVE-2020-35125 | MA Mautic Acquia | 9.6 | Feb 9 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different… |
| CVE-2020-35124 | MA Mautic Acquia | 9.6 | Jan 28 | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of… |
| CVE-2020-35128 | MA Mautic Acquia | 9.0 | Jan 19 | Mautic before 3.2.4 is affected by stored XSS |
| CVE-2018-11200 | MA Mautic Acquia | 6.1 | Sep 20 | An issue was discovered in Mautic 2.13.1 |
| CVE-2018-11198 | MA Mautic Acquia | 6.1 | Sep 6 | An issue was discovered in Mautic 2.13.1 |
| CVE-2017-1000490 | MA Mautic Acquia | 6.5 | Jan 3 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the… |
| CVE-2017-1000489 | MA Mautic Acquia | 8.1 | Jan 3 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address |
| CVE-2017-1000488 | MA Mautic Acquia | 6.1 | Jan 3 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form |
| CVE-2017-8874 | MA Mautic Acquia | 8.8 | May 10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email… |
| CVE-2015-8754 | MO Mollom Acquia | 7.5 | Jan 8 | The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors |
| CVE-2013-1908 | CO Commons Acquia | – | Jul 16 | The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to… |
| CVE-2013-1907 | CO Commons Acquia | – | Jul 16 | The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to… |
| CVE-2012-4483 | CO Commons Acquia | – | Oct 31 | The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8… |