mautic

Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situ…

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However …

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive informat…

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. …

Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a S…

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Us…

Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retri…

Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could i…