Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/744238?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/744238?format=api", "purl": "pkg:composer/mautic/core-lib@5.0.0-rc2", "type": "composer", "namespace": "mautic", "name": "core-lib", "version": "5.0.0-rc2", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.1.1", "latest_non_vulnerable_version": "5.1.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/163400?format=api", "vulnerability_id": "VCID-3g4e-a7qf-7bg1", "summary": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25770", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00296", "scoring_system": "epss", "scoring_elements": "0.53427", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00296", "scoring_system": "epss", "scoring_elements": "0.5343", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00296", "scoring_system": "epss", "scoring_elements": "0.53442", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00296", "scoring_system": "epss", "scoring_elements": "0.53302", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25770" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca" }, { "reference_url": "https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25770", "reference_id": "CVE-2022-25770", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25770" }, { "reference_url": "https://github.com/advisories/GHSA-qf6m-6m4g-rmrc", "reference_id": "GHSA-qf6m-6m4g-rmrc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qf6m-6m4g-rmrc" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc", "reference_id": "GHSA-qf6m-6m4g-rmrc", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T14:47:02Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2022-25770", "GHSA-qf6m-6m4g-rmrc" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "7.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3g4e-a7qf-7bg1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/157522?format=api", "vulnerability_id": "VCID-6udr-t1gz-yydw", "summary": "Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-27917", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0045", "scoring_system": "epss", "scoring_elements": "0.6419", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0045", "scoring_system": "epss", "scoring_elements": "0.642", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0045", "scoring_system": "epss", "scoring_elements": "0.64203", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0045", "scoring_system": "epss", "scoring_elements": "0.64086", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-27917" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/550e33562d03363f7592fa9354259787a23a1d98", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/550e33562d03363f7592fa9354259787a23a1d98" }, { "reference_url": "https://github.com/mautic/mautic/commit/629165ac905c53bbb44feb5a6dbadb1dfd6d5564", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/629165ac905c53bbb44feb5a6dbadb1dfd6d5564" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27917", "reference_id": "CVE-2021-27917", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27917" }, { "reference_url": "https://github.com/advisories/GHSA-xpc5-rr39-v8v2", "reference_id": "GHSA-xpc5-rr39-v8v2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xpc5-rr39-v8v2" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2", "reference_id": "GHSA-xpc5-rr39-v8v2", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:40:34Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2021-27917", "GHSA-xpc5-rr39-v8v2" ], "risk_score": 3.3, "exploitability": "0.5", "weighted_severity": "6.6", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6udr-t1gz-yydw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/163458?format=api", "vulnerability_id": "VCID-kb5u-fxss-nqcf", "summary": "The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25768", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00369", "scoring_system": "epss", "scoring_elements": "0.59325", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00369", "scoring_system": "epss", "scoring_elements": "0.59329", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00369", "scoring_system": "epss", "scoring_elements": "0.59338", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00369", "scoring_system": "epss", "scoring_elements": "0.59214", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25768" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "8.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "8.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce" }, { "reference_url": "https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "8.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25768", "reference_id": "CVE-2022-25768", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "8.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25768" }, { "reference_url": "https://github.com/advisories/GHSA-x3jx-5w6m-q2fc", "reference_id": "GHSA-x3jx-5w6m-q2fc", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x3jx-5w6m-q2fc" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc", "reference_id": "GHSA-x3jx-5w6m-q2fc", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "7.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:42:37Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2022-25768", "GHSA-x3jx-5w6m-q2fc" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kb5u-fxss-nqcf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57743?format=api", "vulnerability_id": "VCID-kqrt-jk5r-2ybq", "summary": "This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\n\n * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\n\n\n * Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47051", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01106", "scoring_system": "epss", "scoring_elements": "0.78507", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01106", "scoring_system": "epss", "scoring_elements": "0.78586", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01106", "scoring_system": "epss", "scoring_elements": "0.78591", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01106", "scoring_system": "epss", "scoring_elements": "0.78574", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47051" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca" }, { "reference_url": "https://github.com/mautic/mautic/commit/75bc488ce98b9c8ec01114984049fc1c42c0cae5", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/75bc488ce98b9c8ec01114984049fc1c42c0cae5" }, { "reference_url": "https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47051", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47051" }, { "reference_url": "https://owasp.org/www-community/attacks/Code_Injection", "reference_id": "Code_Injection", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/" } ], "url": "https://owasp.org/www-community/attacks/Code_Injection" }, { "reference_url": "https://github.com/advisories/GHSA-73gx-x7r9-77x2", "reference_id": "GHSA-73gx-x7r9-77x2", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-73gx-x7r9-77x2" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2", "reference_id": "GHSA-73gx-x7r9-77x2", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2" }, { "reference_url": "https://github.com/advisories/GHSA-qf6m-6m4g-rmrc", "reference_id": "GHSA-qf6m-6m4g-rmrc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qf6m-6m4g-rmrc" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc", "reference_id": "GHSA-qf6m-6m4g-rmrc", "reference_type": "", "scores": [], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc" }, { "reference_url": "https://owasp.org/www-community/attacks/Path_Traversal", "reference_id": "Path_Traversal", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/" } ], "url": "https://owasp.org/www-community/attacks/Path_Traversal" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2024-47051", "GHSA-73gx-x7r9-77x2" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kqrt-jk5r-2ybq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/58023?format=api", "vulnerability_id": "VCID-nc5r-759g-qkhx", "summary": "Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47050", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78848", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78861", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78864", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01135", "scoring_system": "epss", "scoring_elements": "0.78782", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47050" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/0f21a3aa9c896788e1986fae0d7f166fc7a14c30", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/0f21a3aa9c896788e1986fae0d7f166fc7a14c30" }, { "reference_url": "https://github.com/mautic/mautic/commit/43db5e492c0ef82c917745849d5b454dbc8ca2c4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/43db5e492c0ef82c917745849d5b454dbc8ca2c4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47050", "reference_id": "CVE-2024-47050", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47050" }, { "reference_url": "https://github.com/advisories/GHSA-73gr-32wg-qhh7", "reference_id": "GHSA-73gr-32wg-qhh7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-73gr-32wg-qhh7" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7", "reference_id": "GHSA-73gr-32wg-qhh7", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:41:10Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2024-47050", "GHSA-73gr-32wg-qhh7" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nc5r-759g-qkhx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57744?format=api", "vulnerability_id": "VCID-qw81-xmgp-t7ag", "summary": "With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47058", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40453", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40465", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40476", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40285", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-47058" }, { "reference_url": "https://github.com/mautic/mautic", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic" }, { "reference_url": "https://github.com/mautic/mautic/commit/344b908ef690283e7d8d3fc5cc1327396a1c3046", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/344b908ef690283e7d8d3fc5cc1327396a1c3046" }, { "reference_url": "https://github.com/mautic/mautic/commit/88153a15b3cea331b7036d956b880c69e81a0032", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/mautic/mautic/commit/88153a15b3cea331b7036d956b880c69e81a0032" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47058", "reference_id": "CVE-2024-47058", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47058" }, { "reference_url": "https://github.com/advisories/GHSA-xv68-rrmw-9xwf", "reference_id": "GHSA-xv68-rrmw-9xwf", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv68-rrmw-9xwf" }, { "reference_url": "https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf", "reference_id": "GHSA-xv68-rrmw-9xwf", "reference_type": "", "scores": [ { "value": "2.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L" }, { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:42:03Z/" } ], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/33474?format=api", "purl": "pkg:composer/mautic/core-lib@5.1.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1" } ], "aliases": [ "CVE-2024-47058", "GHSA-xv68-rrmw-9xwf" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qw81-xmgp-t7ag" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.0.0-rc2" }