What’s Vulnerable › Products
Mautic vulnerabilities
46 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your Mautic version is affected
Latest Mautic vulnerabilities
- CVE-2026-3105 — SQL Injection in Contact Activity API Sorting (CVSS 8.8)
- CVE-2025-13828 — Mautic user without privileged access to the Marketplace can install and uninstall composer packages (CVSS 9.0)
- CVE-2025-13827 — GrapesJsBuilder File Upload allows all file uploads (CVSS 8.8)
- CVE-2025-9824 — User Enumeration via Response Timing (CVSS 5.9)
- CVE-2025-9823 — Reflected XSS in lead:addLeadTags - Quick Add (CVSS 4.8)
- CVE-2025-9822 — Secret data extraction via elfinder (CVSS 5.5)
- CVE-2025-9821 — SSRF via webhook function (CVSS 2.7)
- CVE-2025-5256 — Open Redirect vulnerability on user unlock path (CVSS 5.4)
- CVE-2024-47057 — User name enumeration possible due to response time difference on password reset form (CVSS 5.3)
- CVE-2024-47055 — Segment cloning doesn't have a proper permission check (CVSS 4.3)
- CVE-2025-5257 — Predictable Page Indexing Might Lead to Sensitive Data Exposure (CVSS 6.5)
- CVE-2024-47056 — Mautic does not shield .env files from web traffic (CVSS 5.1)
- CVE-2024-47053 — Improper Authorization in Reporting API (CVSS 7.7)
- CVE-2024-47051 — Remote Code Execution & File Deletion in Asset Uploads (CVSS 9.9)
- CVE-2022-25773 — Relative Path Traversal in assets file upload (CVSS 5.4)
- CVE-2024-47059 — Users enumeration - weak password login (CVSS 4.3)
- CVE-2022-25770 — Insufficient authentication in upgrade flow (CVSS 7.5)
- CVE-2021-27917 — XSS in contact tracking and page hits report (CVSS 5.4)
- CVE-2024-47058 — Cross-site Scripting (XSS) - stored (edit form HTML field) (CVSS 4.8)
- CVE-2024-47050 — XSS in contact/company tracking (no authentication) (CVSS 6.1)
- CVE-2022-25768 — Improper Access Control in UI upgrade process (CVSS 6.5)
- CVE-2022-25777 — Server-Side Request Forgery in Asset section (CVSS 6.5)
- CVE-2022-25776 — Sensitive Data Exposure due to inadequate user permission settings (CVSS 6.5)
- CVE-2022-25775 — SQL Injection in dynamic Reports (CVSS 7.2)
- CVE-2022-25774 — XSS in Notifications via saving Dashboards (CVSS 5.4)