Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115193

Quick assessment

Affected
CVE-2026-115193
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mautic 7 的联系人详情视图存在存储型跨站脚本（XSS）漏洞。HTML 类型的自定义联系人字段值在渲染时未经过输出净化处理。任何能够向此类字段写入值的用户或集成（例如通过联系人编辑、联系人 API 或映射到该字段的表单提交），均可将脚本载荷存储其中。当其他用户（包括管理员）打开受影响的联系人详情页面时，注入的脚本将在其当前浏览器会话的上下文中执行。攻击者可借此以受害者身份执行管理操作，例如创建新的管理员账户、修改系统配置，或访问联系人及营销活动数据。

CVSS 8.2 · High

I. Basic Information for CVE-2026-115193

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 7.0.0 ~ 7.2.2 -

II. Public POCs for CVE-2026-115193

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115193

请登录查看更多情报信息。

Other References for CVE-2026-115193 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79