MA
Vendor
Mautic
25
CVEs
0
On KEV
0
New 30D
Products
MA9.8
Mautic
Mautic
21 CVEs0 on KEV0 new
MA9.9
mautic/core
Mautic
3 CVEs0 on KEV0 new
DM5.3
Docker Mautic
mautic
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-3105 | MA Mautic Mautic | 8.8 | Feb 24 | SQL Injection in Contact Activity API Sorting |
| CVE-2025-13828 | MA Mautic Mautic | 9.0 | Dec 2 | Mautic user without privileged access to the Marketplace can install and uninstall composer packages |
| CVE-2025-13827 | MA Mautic Mautic | 8.8 | Dec 2 | GrapesJsBuilder File Upload allows all file uploads |
| CVE-2025-9823 | MA Mautic Mautic | 4.8 | Sep 3 | Reflected XSS in lead:addLeadTags - Quick Add |
| CVE-2025-9824 | MA Mautic Mautic | 5.9 | Sep 3 | User Enumeration via Response Timing |
| CVE-2025-9822 | MA Mautic Mautic | 5.5 | Sep 3 | Secret data extraction via elfinder |
| CVE-2025-9821 | MA Mautic Mautic | 2.7 | Sep 3 | SSRF via webhook function |
| CVE-2025-7381 | DM Docker Mautic mautic | 5.3 | Jul 9 | Exposure of sensitive PHP information to an unauthorized control sphere in mautic/mautic images |
| CVE-2025-5256 | MA Mautic Mautic | 5.4 | May 28 | Open Redirect vulnerability on user unlock path |
| CVE-2024-47055 | MA Mautic Mautic | 4.3 | May 28 | Segment cloning doesn't have a proper permission check |
| CVE-2024-47057 | MA Mautic Mautic | 5.3 | May 28 | User name enumeration possible due to response time difference on password reset form |
| CVE-2024-47056 | MA Mautic Mautic | 5.1 | May 28 | Mautic does not shield .env files from web traffic |
| CVE-2025-5257 | MA Mautic Mautic | 6.5 | May 28 | Predictable Page Indexing Might Lead to Sensitive Data Exposure |
| CVE-2024-47051 | MA mautic/core Mautic | 9.9 | Feb 26 | Remote Code Execution & File Deletion in Asset Uploads |
| CVE-2024-47053 | MA mautic/core Mautic | 7.7 | Feb 26 | Improper Authorization in Reporting API |
| CVE-2022-25773 | MA mautic/core Mautic | 5.4 | Feb 26 | Relative Path Traversal in assets file upload |
| CVE-2020-35129 | MA Mautic Mautic | 9.0 | Jan 19 | Mautic before 3.2.4 is affected by stored XSS |
| CVE-2018-8092 | MA Mautic Mautic | 9.8 | Apr 18 | Mautic before 2.13.0 allows CSV injection |
| CVE-2018-8071 | MA Mautic Mautic | 6.1 | Apr 18 | Mautic before v2.13.0 has stored XSS via a theme config file |
| CVE-2018-10189 | MA Mautic Mautic | 7.5 | Apr 17 | An issue was discovered in Mautic 1.x and 2.x before 2.13.0 |
| CVE-2017-1000506 | MA Mautic Mautic | 6.1 | Feb 9 | Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code |
| CVE-2017-1000490 | MA Mautic Mautic | 6.5 | Jan 3 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the… |
| CVE-2017-1000489 | MA Mautic Mautic | 8.1 | Jan 3 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address |
| CVE-2017-1000488 | MA Mautic Mautic | 6.1 | Jan 3 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form |
| CVE-2017-1000046 | MA Mautic Mautic | 7.5 | Jul 17 | Mautic 2.6.1 and earlier fails to set flags on session cookies |