Vulnerabilities

TI-2020-17841 CVE-2020-35129 · GHSA-3px5-wjh3-9x6r

Mautic before 3.2.4 is affected by stored XSS.

MEDIUM 41

Mautic before 3.2.4 is affected by stored XSS.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01018 Published 2021-01-19 Fixed in 3.2.4 CWE-79

TI-2018-05847 CVE-2018-8092 · GHSA-29v9-2fpx-j5g9

Mautic before 2.13.0 allows CSV injection.

MEDIUM 45

Mautic before 2.13.0 allows CSV injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01633 Published 2018-04-18 Fixed in 2.13.0 CWE-1236

TI-2018-05838 CVE-2018-8071 · GHSA-5w74-jx7m-x6hv

Mautic before v2.13.0 has stored XSS via a theme config file.

LOW 29

Mautic before v2.13.0 has stored XSS via a theme config file.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00811 Published 2018-04-18 Fixed in 2.13.0 CWE-79

TI-2018-07222 CVE-2018-10189 · GHSA-vfxj-qg93-7wwc

An issue was discovered in Mautic 1.x and 2.x before 2.13.0.

LOW 35

An issue was discovered in Mautic 1.x and 2.x before 2.13.0.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01136 Published 2018-04-17 Fixed in 2.13.0 CWE-200

TI-2017-14714 CVE-2017-1000506 · GHSA-358v-cqjc-2pcq

Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in…

LOW 29

Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01086 Published 2018-02-09 Fixed in 2.14.2 CWE-79

TI-2017-14699 CVE-2017-1000490 · GHSA-qpgw-2c72-4c89

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user…

LOW 32

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01403 Published 2018-01-03 Fixed in 2.12.0 CWE-22

TI-2017-14698 CVE-2017-1000489 · GHSA-6x98-fx9j-7c78

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to…

LOW 37

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01116 Published 2018-01-03 Fixed in 2.12.0 CWE-287

TI-2017-14697 CVE-2017-1000488 · GHSA-qjhr-c23f-w76q

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic…

LOW 29

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00843 Published 2018-01-03 Fixed in 2.12.0 CWE-79

TI-2017-14388 CVE-2017-1000046 · GHSA-8255-qf34-44mp

Mautic 2.6.1 and earlier fails to set flags on session cookies

LOW 35

Mautic 2.6.1 and earlier fails to set flags on session cookies

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01107 Published 2017-07-13 Fixed in 2.1.1 CWE-614

Vulnerabilities

Filters