{"url":"http://public2.vulnerablecode.io/api/packages/744232?format=json","purl":"pkg:composer/mautic/core-lib@4.4.11","type":"composer","namespace":"mautic","name":"core-lib","version":"4.4.11","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.4.13","latest_non_vulnerable_version":"5.1.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/163400?format=json","vulnerability_id":"VCID-3g4e-a7qf-7bg1","summary":"Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25770","reference_id":"","reference_type":"","scores":[{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53427","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.5343","published_at":"2026-06-14T12:55:00Z"},{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53442","published_at":"2026-06-13T12:55:00Z"},{"value":"0.00296","scoring_system":"epss","scoring_elements":"0.53302","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25770"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca"},{"reference_url":"https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25770","reference_id":"CVE-2022-25770","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25770"},{"reference_url":"https://github.com/advisories/GHSA-qf6m-6m4g-rmrc","reference_id":"GHSA-qf6m-6m4g-rmrc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qf6m-6m4g-rmrc"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc","reference_id":"GHSA-qf6m-6m4g-rmrc","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T14:47:02Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2022-25770","GHSA-qf6m-6m4g-rmrc"],"risk_score":3.5,"exploitability":"0.5","weighted_severity":"7.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3g4e-a7qf-7bg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/157522?format=json","vulnerability_id":"VCID-6udr-t1gz-yydw","summary":"Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27917","reference_id":"","reference_type":"","scores":[{"value":"0.0045","scoring_system":"epss","scoring_elements":"0.6419","published_at":"2026-06-12T12:55:00Z"},{"value":"0.0045","scoring_system":"epss","scoring_elements":"0.642","published_at":"2026-06-14T12:55:00Z"},{"value":"0.0045","scoring_system":"epss","scoring_elements":"0.64203","published_at":"2026-06-13T12:55:00Z"},{"value":"0.0045","scoring_system":"epss","scoring_elements":"0.64086","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27917"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/550e33562d03363f7592fa9354259787a23a1d98","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/550e33562d03363f7592fa9354259787a23a1d98"},{"reference_url":"https://github.com/mautic/mautic/commit/629165ac905c53bbb44feb5a6dbadb1dfd6d5564","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/629165ac905c53bbb44feb5a6dbadb1dfd6d5564"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27917","reference_id":"CVE-2021-27917","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27917"},{"reference_url":"https://github.com/advisories/GHSA-xpc5-rr39-v8v2","reference_id":"GHSA-xpc5-rr39-v8v2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xpc5-rr39-v8v2"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2","reference_id":"GHSA-xpc5-rr39-v8v2","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:40:34Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-xpc5-rr39-v8v2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2021-27917","GHSA-xpc5-rr39-v8v2"],"risk_score":3.3,"exploitability":"0.5","weighted_severity":"6.6","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6udr-t1gz-yydw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/163458?format=json","vulnerability_id":"VCID-kb5u-fxss-nqcf","summary":"The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25768","reference_id":"","reference_type":"","scores":[{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.59325","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.59329","published_at":"2026-06-14T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.59338","published_at":"2026-06-13T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.59214","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25768"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/89f964d06f00688016b38a56dfd9e95fc676c7ce"},{"reference_url":"https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b","reference_id":"","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/925aeee7d3dbb6ca67f92d9dc5893d99250f739b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25768","reference_id":"CVE-2022-25768","reference_type":"","scores":[{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25768"},{"reference_url":"https://github.com/advisories/GHSA-x3jx-5w6m-q2fc","reference_id":"GHSA-x3jx-5w6m-q2fc","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x3jx-5w6m-q2fc"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc","reference_id":"GHSA-x3jx-5w6m-q2fc","reference_type":"","scores":[{"value":"7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"7.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:42:37Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-x3jx-5w6m-q2fc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2022-25768","GHSA-x3jx-5w6m-q2fc"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kb5u-fxss-nqcf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57743?format=json","vulnerability_id":"VCID-kqrt-jk5r-2ybq","summary":"This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users.\n\n  *  Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insufficient enforcement of allowed file extensions allows an attacker to bypass restrictions and upload executable files, such as PHP scripts.\n\n\n  *  Path Traversal File Deletion: A Path Traversal vulnerability exists in the upload validation process. Due to improper handling of path components, an authenticated user can manipulate the file deletion process to delete arbitrary files on the host system.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47051","reference_id":"","reference_type":"","scores":[{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78507","published_at":"2026-06-11T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78586","published_at":"2026-06-14T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78591","published_at":"2026-06-13T12:55:00Z"},{"value":"0.01106","scoring_system":"epss","scoring_elements":"0.78574","published_at":"2026-06-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47051"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/mautic/mautic/commit/73b18e9a434a28e528fe0e3d03620e7367bdcdca"},{"reference_url":"https://github.com/mautic/mautic/commit/75bc488ce98b9c8ec01114984049fc1c42c0cae5","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/75bc488ce98b9c8ec01114984049fc1c42c0cae5"},{"reference_url":"https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/mautic/mautic/commit/aee7bfb7510a83acf178a7f02da9661c040e9abf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47051","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47051"},{"reference_url":"https://owasp.org/www-community/attacks/Code_Injection","reference_id":"Code_Injection","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/"}],"url":"https://owasp.org/www-community/attacks/Code_Injection"},{"reference_url":"https://github.com/advisories/GHSA-73gx-x7r9-77x2","reference_id":"GHSA-73gx-x7r9-77x2","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-73gx-x7r9-77x2"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2","reference_id":"GHSA-73gx-x7r9-77x2","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-73gx-x7r9-77x2"},{"reference_url":"https://github.com/advisories/GHSA-qf6m-6m4g-rmrc","reference_id":"GHSA-qf6m-6m4g-rmrc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qf6m-6m4g-rmrc"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc","reference_id":"GHSA-qf6m-6m4g-rmrc","reference_type":"","scores":[],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-qf6m-6m4g-rmrc"},{"reference_url":"https://owasp.org/www-community/attacks/Path_Traversal","reference_id":"Path_Traversal","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-26T14:29:14Z/"}],"url":"https://owasp.org/www-community/attacks/Path_Traversal"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2024-47051","GHSA-73gx-x7r9-77x2"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kqrt-jk5r-2ybq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/58023?format=json","vulnerability_id":"VCID-nc5r-759g-qkhx","summary":"Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47050","reference_id":"","reference_type":"","scores":[{"value":"0.01135","scoring_system":"epss","scoring_elements":"0.78848","published_at":"2026-06-12T12:55:00Z"},{"value":"0.01135","scoring_system":"epss","scoring_elements":"0.78861","published_at":"2026-06-14T12:55:00Z"},{"value":"0.01135","scoring_system":"epss","scoring_elements":"0.78864","published_at":"2026-06-13T12:55:00Z"},{"value":"0.01135","scoring_system":"epss","scoring_elements":"0.78782","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47050"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/0f21a3aa9c896788e1986fae0d7f166fc7a14c30","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/0f21a3aa9c896788e1986fae0d7f166fc7a14c30"},{"reference_url":"https://github.com/mautic/mautic/commit/43db5e492c0ef82c917745849d5b454dbc8ca2c4","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/43db5e492c0ef82c917745849d5b454dbc8ca2c4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47050","reference_id":"CVE-2024-47050","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47050"},{"reference_url":"https://github.com/advisories/GHSA-73gr-32wg-qhh7","reference_id":"GHSA-73gr-32wg-qhh7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-73gr-32wg-qhh7"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7","reference_id":"GHSA-73gr-32wg-qhh7","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:41:10Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-73gr-32wg-qhh7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2024-47050","GHSA-73gr-32wg-qhh7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nc5r-759g-qkhx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/57744?format=json","vulnerability_id":"VCID-qw81-xmgp-t7ag","summary":"With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47058","reference_id":"","reference_type":"","scores":[{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40453","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40465","published_at":"2026-06-14T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40476","published_at":"2026-06-13T12:55:00Z"},{"value":"0.00186","scoring_system":"epss","scoring_elements":"0.40285","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47058"},{"reference_url":"https://github.com/mautic/mautic","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic"},{"reference_url":"https://github.com/mautic/mautic/commit/344b908ef690283e7d8d3fc5cc1327396a1c3046","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/344b908ef690283e7d8d3fc5cc1327396a1c3046"},{"reference_url":"https://github.com/mautic/mautic/commit/88153a15b3cea331b7036d956b880c69e81a0032","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/mautic/mautic/commit/88153a15b3cea331b7036d956b880c69e81a0032"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47058","reference_id":"CVE-2024-47058","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47058"},{"reference_url":"https://github.com/advisories/GHSA-xv68-rrmw-9xwf","reference_id":"GHSA-xv68-rrmw-9xwf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xv68-rrmw-9xwf"},{"reference_url":"https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf","reference_id":"GHSA-xv68-rrmw-9xwf","reference_type":"","scores":[{"value":"2.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L"},{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"5.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-19T15:42:03Z/"}],"url":"https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33469?format=json","purl":"pkg:composer/mautic/core-lib@4.4.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.13"},{"url":"http://public2.vulnerablecode.io/api/packages/33474?format=json","purl":"pkg:composer/mautic/core-lib@5.1.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@5.1.1"}],"aliases":["CVE-2024-47058","GHSA-xv68-rrmw-9xwf"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qw81-xmgp-t7ag"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/mautic/core-lib@4.4.11"}