Mautic

A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript

Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data.

Users with low privileges (all permissions deselected in the administrator permissions settings) can view certain pages that expose sensitive information such as company names, users' names and surnames, stage names, and…

Users with low privileges can perform certain AJAX actions.

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3.

Mautic before 2.13.0 allows CSV injection.

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions.

Mautic before 3.2.4 is affected by stored XSS.

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted.

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities.

Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion.

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering…

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function.

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.

SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines.

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation.

For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code.

An issue was discovered in Mautic 1.x and 2.x before 2.13.0.

Mautic 2.6.1 and earlier fails to set flags on session cookies

Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.

Mautic allows you to update the application via an upgrade script.

A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript