Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Mautic — Vulnerabilities & Security Advisories 36

All 36 CVE vulnerabilities found in Mautic, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for Mautic, an open-source marketing automation platform, covering Common Weakness Enumerations associated with its software releases. It collects known security flaws and misconfigurations identified by vendors, independent researchers, and automated scanning tools, spanning from the initial public releases up to the most recent updates available in the database. The coverage focuses on critical, high, and medium severity issues that impact confidentiality, integrity, and availability within the application’s core features and integrations. Here, you can track a vendor's advisories by following the chronological updates released by the Mautic team and security researchers. You can also understand a weakness class by examining how specific coding errors or architectural decisions in the PHP-based system lead to exploitable conditions such as injection attacks or cross-site scripting. Furthermore, you can look up a product's vulnerability history by reviewing the lifecycle of security patches and the frequency of reported defects over time. This structured view helps security professionals assess the overall risk posture of the Mautic platform, compare historical trends, and prioritize remediation efforts based on the severity and prevalence of discovered flaws. The data serves as a reference for auditing, compliance checks, and developing mitigation strategies for organizations deploying or maintaining this marketing automation solution in their infrastructure environments.

Vendor: Mautic

CVE ID Title CVSS Severity Published
CVE-2026-3105 SQL Injection in Contact Activity API Sorting CWE-89 7.6 High 2026-02-24
CVE-2025-13828 Mautic user without privileged access to the Marketplace can install and uninstall composer packages CWE-862 7.8AI High AI 2025-12-02
CVE-2025-13827 GrapesJsBuilder File Upload allows all file uploads CWE-434 9.8AI Critical AI 2025-12-02
CVE-2025-9823 Reflected XSS in lead:addLeadTags - Quick Add CWE-79 6.1AI Medium AI 2025-09-03
CVE-2025-9824 User Enumeration via Response Timing CWE-204 5.9 Medium 2025-09-03
CVE-2025-9822 Secret data extraction via elfinder CWE-283 5.5 Medium 2025-09-03
CVE-2025-9821 SSRF via webhook function CWE-918 2.7 Low 2025-09-03
CVE-2025-5256 Open Redirect vulnerability on user unlock path CWE-601 5.4 Medium 2025-05-28
CVE-2024-47055 Segment cloning doesn't have a proper permission check CWE-862 4.3 Medium 2025-05-28
CVE-2024-47057 User name enumeration possible due to response time difference on password reset form CWE-203 5.3 Medium 2025-05-28
CVE-2024-47056 Mautic does not shield .env files from web traffic CWE-312 5.1 Medium 2025-05-28
CVE-2025-5257 Predictable Page Indexing Might Lead to Sensitive Data Exposure CWE-1284 6.5 Medium 2025-05-28
CVE-2022-25770 Insufficient authentication in upgrade flow CWE-306 7.8 High 2024-09-18
CVE-2024-47059 Users enumeration - weak password login CWE-200 4.3 Medium 2024-09-18
CVE-2021-27917 XSS in contact tracking and page hits report CWE-79 7.3 High 2024-09-18
CVE-2024-47050 XSS in contact/company tracking (no authentication) CWE-79 5.4 Medium 2024-09-18
CVE-2024-47058 Cross-site Scripting (XSS) - stored (edit form HTML field) CWE-79 2.9 Low 2024-09-18
CVE-2022-25768 Improper Access Control in UI upgrade process CWE-287 7.0 High 2024-09-18
CVE-2022-25777 Server-Side Request Forgery in Asset section CWE-918 6.5 Medium 2024-09-18
CVE-2022-25776 Sensitive Data Exposure due to inadequate user permission settings CWE-276 8.3 High 2024-09-18
CVE-2022-25775 SQL Injection in dynamic Reports CWE-89 6.6 Medium 2024-09-18
CVE-2022-25774 XSS in Notifications via saving Dashboards CWE-79 4.8 Medium 2024-09-18
CVE-2022-25769 Improper regex in htaccess file CWE-1284 7.2 High 2024-09-18
CVE-2021-27916 Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder) CWE-22 8.1 High 2024-09-17
CVE-2021-27915 XSS Cross-site Scripting Stored (XSS) - Description field CWE-80 7.6 High 2024-09-17
CVE-2024-3448 Improper Access Control Leads to Server-Side Request Forgery in Mautic CWE-918 5.0 Medium 2024-04-10
CVE-2024-2731 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CWE-284 5.4 Medium 2024-04-10
CVE-2024-2730 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CWE-425 5.3 Medium 2024-04-10
CVE-2022-25772 Mautic 跨站脚本漏洞 CWE-79 9.6 Critical 2022-06-20
CVE-2021-27914 Mautic 跨站脚本漏洞 CWE-79 7.6 High 2022-06-01

All 36 known CVE vulnerabilities affecting Mautic with full Chinese analysis, references, and POCs where available.