Search for packages
| purl | pkg:composer/mautic/core@5.2.8 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a3qv-sg57-gfd4
Aliases: CVE-2025-13828 GHSA-3fq7-c5m8-g86x |
Mautic user without privileged access to the Marketplace can install and uninstall composer packages A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-swy6-81uq-4kcs
Aliases: CVE-2026-3105 GHSA-r5j5-q42h-fc93 |
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-f8d8-kqpm-ekhc | Mautic Vulnerable to User Enumeration via Response Timing The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. |
CVE-2025-9824
GHSA-3ggv-qwcp-j6xg |
| VCID-fa5a-r46u-nbfm | Mautic vulnerable to SSRF via webhook function Users with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed |
CVE-2025-9821
GHSA-hj6f-7hp7-xg69 |
| VCID-qz5x-pz9p-93eu | Mautic vulnerable to secret data extraction via elfinder _A user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available._ |
CVE-2025-9822
GHSA-438m-6mhw-hq5w |
| VCID-s7r1-3b25-bbe6 | Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add A Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application. |
CVE-2025-9823
GHSA-9v8p-m85m-f7mm |