CRITICAL9.8Packagist
GHSA-29v9-2fpx-j5g9· CVE-2018-8092CSV Injection vulnerability with exported contact lists in Mautic
Modified: 11/8/2023
package
Packagist/mautic/core
pkg:packagist/mautic/core
HIGH7.1Packagist
GHSA-2jrw-c95w-h43g· CVE-2026-9808Mautic has an Authorization Bypass in API v2 Endpoints
Modified: 9/10/2026
HIGH7.6Packagist
GHSA-2rc5-2755-v422· CVE-2021-27915Mautic vulnerable to stored cross-site scripting in description field
Modified: 9/30/2024
MEDIUM6.3Packagist
GHSA-32hw-3pvh-vcvc· CVE-2021-27909XSS vulnerability on password reset page
Modified: 7/8/2026
MEDIUM6.1Packagist
GHSA-358v-cqjc-2pcq· CVE-2017-1000506Mautic Cross Site Scripting (XSS) vulnerability
Modified: 4/23/2024
CRITICALPackagist
GHSA-39wj-j3jc-858m· CVE-2020-35124XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
Modified: 7/8/2026
CRITICALPackagist
GHSA-3fq7-c5m8-g86x· CVE-2025-13828Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Modified: 12/2/2025
MEDIUM5.9Packagist
GHSA-3ggv-qwcp-j6xg· CVE-2025-9824Mautic Vulnerable to User Enumeration via Response Timing
Modified: 9/3/2025
CRITICAL9.0Packagist
GHSA-3px5-wjh3-9x6r· CVE-2020-35129Mautic stored Cross-site Scripting (XSS)
Modified: 4/23/2024
MEDIUM5.3Packagist
GHSA-424x-cxvh-wq9p· CVE-2024-47057Mautic allows user name enumeration due to response time difference on password reset form
Modified: 5/28/2025
CRITICAL9.6Packagist
GHSA-42q7-95j7-w62m· CVE-2020-35125Mautic is vulnerable to XSS vulnerability
Modified: 7/8/2026
MEDIUM5.5Packagist
GHSA-438m-6mhw-hq5w· CVE-2025-9822Mautic vulnerable to secret data extraction via elfinder
Modified: 9/3/2025
MEDIUM5.8Packagist
GHSA-4hjq-422q-4vpx· CVE-2021-27908Mautic vulnerable to secret data exfiltration via symfony parameters
Modified: 7/8/2026
MEDIUM4.3Packagist
GHSA-4w2w-36vm-c8hf· CVE-2022-25773Mautic allows Relative Path Traversal in assets file upload
Modified: 10/16/2025
MEDIUM5.4Packagist
GHSA-5hvg-w58j-545m· CVE-2026-9811Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-5w74-jx7m-x6hv· CVE-2018-8071XSS vulnerability in theme config file in Mautic
Modified: 2/16/2024
CRITICAL9.9Packagist
GHSA-6r9h-4h75-7q4x· CVE-2026-9559Mautic vulnerable to Path Traversal via Campaign Import
Modified: 9/10/2026
MEDIUM5.4Packagist
GHSA-6vx9-9r2g-8373· CVE-2025-5256Mautic has an Open Redirect vulnerability on user unlock path.
Modified: 5/28/2025
HIGH8.1Packagist
GHSA-6x98-fx9j-7c78· CVE-2017-1000489Disabled users able to log in with third party SSO plugin
Modified: 2/16/2024
HIGH8.3Packagist
GHSA-72hm-fx78-xwhc· CVE-2021-27911XSS vulnerability on contacts view
Modified: 7/8/2026
MEDIUM5.4Packagist
GHSA-73gr-32wg-qhh7· CVE-2024-47050Mautic vulnerable to XSS in contact/company tracking (no authentication)
Modified: 9/27/2024
CRITICAL9.1Packagist
GHSA-73gx-x7r9-77x2· CVE-2024-47051Mautic allows Remote Code Execution and File Deletion in Asset Uploads
Modified: 10/16/2025
HIGH7.6Packagist
GHSA-7h65-whp7-rgqf· CVE-2026-9809Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
Modified: 9/10/2026
HIGH8.8Packagist
GHSA-7vvh-xqq4-w777· CVE-2017-8874Mautic Cross-Site Request Forgery (CSRF)
Modified: 4/23/2024
HIGH7.5Packagist
GHSA-8255-qf34-44mp· CVE-2017-1000046Sensitive Cookie Without HttpOnly and Secure Flag
Modified: 4/23/2024
HIGH8.2Packagist
GHSA-86pv-95mj-7w5f· CVE-2021-27910Stored XSS vulnerability on Bounce Management Callback
Modified: 7/8/2026
MEDIUM4.3Packagist
GHSA-8vff-35qm-qjvv· CVE-2024-47059Mautic allows users enumeration due to weak password login
Modified: 9/19/2024
HIGH7.7Packagist
GHSA-8xv7-g2q3-fqgc· CVE-2024-47053Mautic allows Improper Authorization in Reporting API
Modified: 10/16/2025
CRITICAL9.0Packagist
GHSA-98j2-3jv7-274m· CVE-2020-35128Mautic stored Cross-site Scripting (XSS)
Modified: 4/23/2024
HIGH8.1Packagist
GHSA-9fcx-cv56-w58p· CVE-2021-27916Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder
Modified: 10/2/2024
CRITICAL9.9Packagist
GHSA-9fx4-7cmj-47vg· CVE-2026-9558Mautic has Server-Side Template Injection (SSTI) in Theme Templates
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-9hx7-rg7w-xm79· CVE-2018-11200XSS vulnerability in company name field in Mautic
Modified: 11/8/2023
MEDIUMPackagist
GHSA-9v8p-m85m-f7mm· CVE-2025-9823Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add
Modified: 9/3/2025
MEDIUM6.5Packagist
GHSA-cqx4-9vqf-q3m8· CVE-2025-5257Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure
Modified: 5/28/2025
HIGH7.1Packagist
GHSA-fcmw-wx57-9p75· CVE-2026-4776Mautic has SQL Injection in API Contact Filtering
Modified: 9/10/2026
MEDIUM4.8Packagist
GHSA-fhcx-f7jg-jx3f· CVE-2022-25774Mautic vulnerable to cross-site scripting in notifications via saving Dashboards
Modified: 9/18/2024
MEDIUM5.1Packagist
GHSA-h2wg-v8wg-jhxh· CVE-2024-47056Mautic does not shield .env files from web traffic
Modified: 5/28/2025
LOW2.7Packagist
GHSA-hj6f-7hp7-xg69· CVE-2025-9821Mautic vulnerable to SSRF via webhook function
Modified: 9/3/2025
MEDIUM6.6Packagist
GHSA-jj6w-2cqg-7p94· CVE-2022-25775Mautic SQL Injection in dynamic Reports
Modified: 9/18/2024
MEDIUM6.4Packagist
GHSA-jmv8-8j9j-rcpc· CVE-2026-9557Mautic Focus component Vulnerable to SSRF
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-mgv8-w49f-822w· CVE-2022-25777Mautic: MST-48 Server-Side Request Forgery in Asset section
Modified: 9/18/2024
MEDIUMPackagist
GHSA-mj6m-246h-9w56· CVE-2022-25769Improper regex in htaccess file
Modified: 12/5/2024
HIGHPackagist
GHSA-p7v4-gm6j-cw9m· CVE-2021-3142XSS in Mautic
Modified: 11/30/2024
CRITICAL9.6Packagist
GHSA-pjpc-87mp-4332· CVE-2022-25772Cross-site Scripting vulnerability in Mautic's tracking pixel functionality
Modified: 7/8/2026
HIGH7.8Packagist
GHSA-qf6m-6m4g-rmrc· CVE-2022-25770Mautic has insufficient authentication in upgrade flow
Modified: 2/21/2025
MEDIUM6.1Packagist
GHSA-qjhr-c23f-w76q· CVE-2017-1000488Inline JS XSS vulnerability in Mautic
Modified: 11/8/2023
HIGH8.3Packagist
GHSA-qjx3-2g35-6hv8· CVE-2022-25776Mautic Sensitive Data Exposure due to inadequate user permission settings
Modified: 9/18/2024
MEDIUM6.5Packagist
GHSA-qpgw-2c72-4c89· CVE-2017-1000490Mautic users able to download any files from server using filemanager
Modified: 2/16/2024
HIGH7.6Packagist
GHSA-r5j5-q42h-fc93· CVE-2026-3105Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Modified: 2/25/2026
HIGH7.1Packagist
GHSA-rh5w-82wh-jhr8· CVE-2021-27912XSS vulnerability on asset view
Modified: 7/8/2026
HIGH7.5Packagist
GHSA-vfxj-qg93-7wwc· CVE-2018-10189Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
Modified: 2/16/2024
MEDIUM4.3Packagist
GHSA-vph5-ghq3-q782· CVE-2024-47055Mautic segment cloning doesn't have a proper permission check
Modified: 5/28/2025
HIGH7.0Packagist
GHSA-x3jx-5w6m-q2fc· CVE-2022-25768Mautic vulnerable to Improper Access Control in UI upgrade process
Modified: 2/28/2025
LOW3.5Packagist
GHSA-x7g2-wrrp-r6h3· CVE-2021-27913Use of a Broken or Risky Cryptographic Algorithm
Modified: 7/8/2026
MEDIUM6.1Packagist
GHSA-xcf7-cj8q-pcjm· CVE-2018-11198XSS vulnerability in Author URL of themes in Mautic
Modified: 2/16/2024
HIGH7.3Packagist
GHSA-xpc5-rr39-v8v2· CVE-2021-27917Mautic has an XSS in contact tracking and page hits report
Modified: 9/27/2024
MEDIUM4.8Packagist
GHSA-xv68-rrmw-9xwf· CVE-2024-47058Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)
Modified: 9/27/2024