Mautic <3.3.4 - Cross-Site Scripting

Mautic before 3.3.4 contains a cross-site scripting vulnerability on the password reset page in the bundle parameter of the URL. An attacker can inject arbitrary script, steal cookie-based authentication credentials, and/or launch other attacks. id: CVE-2021-27909 info: name: Mautic 3.3.4 -...

cve-2026-9558-poc

CVE-2026-9558 — Mautic Theme Templates Server-Side Template Injection SSTI to Full Admin Takeover Table of Contents Overview Affected Versions Root Cause Analysis Repository Structure Requirements Usage Expected Output References Disclaimer Overview CVE-2026-9558 is a Server-Side Template Injecti...

CVE-2026-115195

A flaw was found in Mautic. Due to missing permission enforcement in the Stats application programming interface API, internal database tables are accessible by default without proper authorization. An authenticated remote user, even with an account lacking assigned privileges, can query these...

CVE-2026-115190

A flaw was found in Mautic. Several application components process stored data from the database without restricting which program objects can be created during deserialization the process of converting stored data back into active objects. An authenticated attacker with high privileges can explo...

Mautic: RCE

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1. The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages such as campaigns, emails, and for...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1.The vulnerability exists in the Project Selector component, where project names returned via an AJAX request are inserted into the page without proper output...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115190

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

CVE-2026-115193

A stored Cross-Site Scripting XSS vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field for example, through contact editing, the contact API, or ...

CVE-2026-115194

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-115189

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

EUVD-2026-109800

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...