Acquia Mautic
35 CVEs affecting Acquia Mautic. Latest disclosed: 2026-02-24. Critical: 5, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25772 | Critical | 9.6 | 2022-06-20 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript |
CVE-2020-35125 | Critical | 9.6 | 2021-02-09 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[ret… |
CVE-2020-35124 | Critical | 9.6 | 2021-01-28 | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the R… |
CVE-2024-47051 | Critical | 9.1 | 2025-02-26 | This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticate… |
CVE-2020-35128 | Critical | 9.0 | 2021-01-19 | Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including adm… |
CVE-2017-8874 | High | 8.8 | 2017-05-10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) d… |
CVE-2022-25776 | High | 8.3 | 2024-09-18 | Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could… |
CVE-2021-27911 | High | 8.3 | 2021-08-30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's de… |
CVE-2021-27910 | High | 8.2 | 2021-08-30 | Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted i… |
CVE-2021-27916 | High | 8.1 | 2024-09-17 | Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access th… |
CVE-2017-1000489 | High | 8.1 | 2018-01-03 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address |
CVE-2022-25770 | High | 7.8 | 2024-09-18 | Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. Th… |
CVE-2024-47053 | High | 7.7 | 2025-02-26 | This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensi… |
CVE-2026-3105 | High | 7.6 | 2026-02-24 | SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query co… |
CVE-2021-27915 | High | 7.6 | 2024-09-17 | Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in use… |
CVE-2021-27914 | High | 7.6 | 2022-06-01 | A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript |
CVE-2021-27917 | High | 7.3 | 2024-09-18 | Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report. |
CVE-2022-25769 | High | 7.2 | 2024-09-18 | ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the applicatio… |
CVE-2021-27912 | High | 7.1 | 2021-08-30 | Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken… |
CVE-2022-25768 | High | 7.0 | 2024-09-18 | The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to t… |