What’s Vulnerable › Vulnerabilities
CVE-2022-25775: SQL Injection in dynamic Reports
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-18 · updated 2026-06-17
- Weakness: CWE-89
Description
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Affected products
- Mautic: from 2.14.1 before 4.4.12; from 5.0.0 before 5.0.4 — fixed in 4.4.12, 5.0.4
How to fix
Upgrade to a fixed version: Mautic 4.4.12, 5.0.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-25775 or the next vulnerability affects your stack