ClickWhale — Vulnerabilities & Security Advisories 6

ClickWhale is a marketing automation platform designed for email campaign management and customer engagement. Historically, the application has been vulnerable to multiple remote code execution (RCE) and cross-site scripting (XSS) flaws, often stemming from improper input validation and insecure deserialization. Privilege escalation vulnerabilities have also been documented, allowing unauthorized access to sensitive campaign data. The platform's six CVEs highlight consistent security weaknesses in its web interface and API endpoints, with several instances enabling complete compromise of affected systems. These vulnerabilities typically arise from insufficient sanitization of user inputs and inadequate access controls, posing significant risks to organizations relying on the platform for customer communications.