Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Mautic < 4.4.17, < 5.2.8, < 6.0.5 Clear all filters
TI-2025-09011 CVE-2025-9823 · GHSA-9v8p-m85m-f7mm

Reflected XSS in lead:addLeadTags - Quick Add

Priority LOW 22

SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00317 Published 2025-09-03 Fixed in < 4.4.17, < 5.2.8 +4 CWE-79
TI-2025-09012 CVE-2025-9824 · GHSA-3ggv-qwcp-j6xg

User Enumeration via Response Timing

Priority LOW 26

ImpactThe attacker can validate if a user exists by checking the time login returns.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00283 Published 2025-09-03 Fixed in < 4.4.17, < 5.2.8 +4 CWE-204
TI-2025-09010 CVE-2025-9822 · GHSA-438m-6mhw-hq5w

Secret data extraction via elfinder

Priority LOW 24

SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00241 Published 2025-09-03 Fixed in < 4.4.17, < 5.2.8 +4 CWE-283