GCVE - cpe:2.3:a:mautic:mautic:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mautic:mautic:-:*:*:*:*:*:*:*

part: a version: - update: *

Vendor	Mautic (`fc271e2e-2a8d-5b94-845e-83256880683c`)
Product	Mautic (`cdcd97d3-2b51-5746-9efd-545b32ff613d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mautic/mautic`	purl2cpe	2026-06-01 10:12:16.219411
`pkg:sourceforge/mautic.mirror`	purl2cpe	2026-06-01 10:12:16.219414

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-3448`	vulnerable	2026-06-08 06:41:53.328814	Improper Access Control Leads to Server-Side Request Forgery in Mautic MEDIUM (5) Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available. Published: 2024-04-10T13:59:46.536Z Updated: 2024-08-01T20:12:07.447Z Open on db.gcve.eu Reference links https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25775`	vulnerable	2026-06-08 05:41:49.417143	SQL Injection in dynamic Reports MEDIUM (6.6) Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems. Published: 2024-09-18T15:01:23.529Z Updated: 2024-09-18T21:30:23.104Z Open on db.gcve.eu Reference links https://github.com/mautic/mautic/security/advisories/GHSA-jj6w-2cqg-7p94	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25769`	vulnerable	2026-06-08 05:41:49.408252	Improper regex in htaccess file HIGH (7.2) ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path. Published: 2024-09-18T14:47:09.029Z Updated: 2024-09-18T21:28:12.305Z Open on db.gcve.eu Reference links https://github.com/mautic/mautic/security/advisories/GHSA-mj6m-246h-9w56 https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-27915`	vulnerable	2026-06-08 05:31:22.744125	XSS Cross-site Scripting Stored (XSS) - Description field HIGH (7.6) Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions. This could lead to the user having elevated access to the system. Published: 2024-09-17T14:02:09.969Z Updated: 2024-09-17T16:01:29.250Z Open on db.gcve.eu Reference links https://github.com/mautic/mautic/security/advisories/GHSA-2rc5-2755-v422	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.