CVE-2026-71245

Mautic's getLeadIdsByFieldValueAction LeadBundle/Controller/AjaxController.php reads a field parameter from the request, sanitizes it only with InputHelper::clean which HTML-entity-encodes quotes and angle brackets but does not restrict other characters, and passes it into...