CSV Injection vulnerability with exported contact lists in Mautic
Modified: 11/8/2023
package
pkg:packagist/mautic/core
CSV Injection vulnerability with exported contact lists in Mautic
Modified: 11/8/2023
Mautic has an Authorization Bypass in API v2 Endpoints
Modified: 9/10/2026
Mautic vulnerable to stored cross-site scripting in description field
Modified: 9/30/2024
XSS vulnerability on password reset page
Modified: 7/8/2026
Mautic Cross Site Scripting (XSS) vulnerability
Modified: 4/23/2024
XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
Modified: 7/8/2026
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Modified: 12/2/2025
Mautic Vulnerable to User Enumeration via Response Timing
Modified: 9/3/2025
Mautic stored Cross-site Scripting (XSS)
Modified: 4/23/2024
Mautic allows user name enumeration due to response time difference on password reset form
Modified: 5/28/2025
Mautic is vulnerable to XSS vulnerability
Modified: 7/8/2026
Mautic vulnerable to secret data extraction via elfinder
Modified: 9/3/2025
Mautic vulnerable to secret data exfiltration via symfony parameters
Modified: 7/8/2026
Mautic allows Relative Path Traversal in assets file upload
Modified: 10/16/2025
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Modified: 9/10/2026
XSS vulnerability in theme config file in Mautic
Modified: 2/16/2024
Mautic vulnerable to Path Traversal via Campaign Import
Modified: 9/10/2026
Mautic has an Open Redirect vulnerability on user unlock path.
Modified: 5/28/2025
Disabled users able to log in with third party SSO plugin
Modified: 2/16/2024
XSS vulnerability on contacts view
Modified: 7/8/2026
Mautic vulnerable to XSS in contact/company tracking (no authentication)
Modified: 9/27/2024
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
Modified: 10/16/2025
Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
Modified: 9/10/2026
Mautic Cross-Site Request Forgery (CSRF)
Modified: 4/23/2024
Sensitive Cookie Without HttpOnly and Secure Flag
Modified: 4/23/2024
Stored XSS vulnerability on Bounce Management Callback
Modified: 7/8/2026
Mautic allows users enumeration due to weak password login
Modified: 9/19/2024
Mautic allows Improper Authorization in Reporting API
Modified: 10/16/2025
Mautic stored Cross-site Scripting (XSS)
Modified: 4/23/2024
Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder
Modified: 10/2/2024
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Modified: 9/10/2026
XSS vulnerability in company name field in Mautic
Modified: 11/8/2023
Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add
Modified: 9/3/2025
Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure
Modified: 5/28/2025
Mautic has SQL Injection in API Contact Filtering
Modified: 9/10/2026
Mautic vulnerable to cross-site scripting in notifications via saving Dashboards
Modified: 9/18/2024
Mautic does not shield .env files from web traffic
Modified: 5/28/2025
Mautic vulnerable to SSRF via webhook function
Modified: 9/3/2025
Mautic SQL Injection in dynamic Reports
Modified: 9/18/2024
Mautic Focus component Vulnerable to SSRF
Modified: 9/10/2026
Mautic: MST-48 Server-Side Request Forgery in Asset section
Modified: 9/18/2024
Improper regex in htaccess file
Modified: 12/5/2024
XSS in Mautic
Modified: 11/30/2024
Cross-site Scripting vulnerability in Mautic's tracking pixel functionality
Modified: 7/8/2026
Mautic has insufficient authentication in upgrade flow
Modified: 2/21/2025
Inline JS XSS vulnerability in Mautic
Modified: 11/8/2023
Mautic Sensitive Data Exposure due to inadequate user permission settings
Modified: 9/18/2024
Mautic users able to download any files from server using filemanager
Modified: 2/16/2024
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Modified: 2/25/2026
XSS vulnerability on asset view
Modified: 7/8/2026
Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
Modified: 2/16/2024
Mautic segment cloning doesn't have a proper permission check
Modified: 5/28/2025
Mautic vulnerable to Improper Access Control in UI upgrade process
Modified: 2/28/2025
Use of a Broken or Risky Cryptographic Algorithm
Modified: 7/8/2026
XSS vulnerability in Author URL of themes in Mautic
Modified: 2/16/2024
Mautic has an XSS in contact tracking and page hits report
Modified: 9/27/2024
Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)
Modified: 9/27/2024