Composer mautic/core has 57 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-25772 | Cross-site Scripting vulnerability in Mautic's tracking pixel functionality | critical | 9.6 | <4.3.0 | 4.3.0 |
| CVE-2021-27909 | XSS vulnerability on password reset page | medium | 6.3 | <3.3.4 or >=4.0.0-alpha1 and <4.0.0 or <4.0.0 or >=3.3.0 and <3.3.4 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 4.0.0 |
| CVE-2020-35125 | Mautic is vulnerable to XSS vulnerability | critical | 9.6 | <2.16.5 or >=3.0.0 and <3.2.4 or >=3.2.0 and <3.2.4 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 or >=2.0.0 and <2.16.5 | 2.16.5, 3.2.4 |
| CVE-2020-35124 | XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic | critical | 0.0 | >=3.0.0 and <3.2.4 or >=2.0.0 and <2.16.5 or >=3.2.0 and <3.2.4 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 3.2.4, 2.16.5 |
| CVE-2024-47051 | Mautic allows Remote Code Execution and File Deletion in Asset Uploads | critical | 9.1 | <5.2.3 | 5.2.3 |
| CVE-2020-35128 | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | >=3.2.0 and <3.2.4 or >=2.0.0 and <2.16.5 | 3.2.4, 2.16.5 |
| CVE-2018-8092 | CSV Injection vulnerability with exported contact lists in Mautic | critical | 9.8 | <2.13.0 | 2.13.0 |
| CVE-2017-1000490 | Mautic users able to download any files from server using filemanager | medium | 6.5 | >=1.0.0 and <2.12.0 | 2.12.0 |
| CVE-2018-10189 | Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID | high | 7.5 | <2.13.0 | 2.13.0 |
| CVE-2017-1000489 | Disabled users able to log in with third party SSO plugin | high | 8.1 | >=2.0.0 and <2.12.0 | 2.12.0 |
| CVE-2017-1000046 | Sensitive Cookie Without HttpOnly and Secure Flag | high | 7.5 | <2.1.1 | 2.1.1 |
| CVE-2017-1000506 | Mautic Cross Site Scripting (XSS) vulnerability | medium | 6.1 | <2.14.2 | 2.14.2 |
| CVE-2020-35129 | Mautic stored Cross-site Scripting (XSS) | critical | 9.0 | <3.2.4 | 3.2.4 |
| CVE-2018-11198 | XSS vulnerability in Author URL of themes in Mautic | medium | 6.1 | >=2.13.1 and <2.14.0 | 2.14.0 |
| CVE-2017-1000488 | Inline JS XSS vulnerability in Mautic | medium | 6.1 | >=2.1.0 and <2.12.0 | 2.12.0 |
| CVE-2018-11200 | XSS vulnerability in company name field in Mautic | medium | 6.1 | <2.14.0 | 2.14.0 |
| CVE-2018-8071 | XSS vulnerability in theme config file in Mautic | medium | 6.1 | <2.13.0 | 2.13.0 |
| CVE-2021-27916 | Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder | high | 8.1 | >=3.3.0 and <4.4.12 or >=5.0.0-alpha and <5.0.4 | 4.4.12, 5.0.4 |
| CVE-2017-8874 | Mautic Cross-Site Request Forgery (CSRF) | high | 8.8 | =1.4.1 | – |
| CVE-2024-47053 | Mautic allows Improper Authorization in Reporting API | high | 7.7 | >=1.0.1 and <5.2.3 | 5.2.3 |
| CVE-2021-27910 | Stored XSS vulnerability on Bounce Management Callback | high | 8.2 | <3.3.4 or >=4.0.0-alpha1 and <4.0.0 or <4.0.0 or >=3.3.0 and <3.3.4 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 4.0.0 |
| CVE-2021-27911 | XSS vulnerability on contacts view | high | 8.3 | <3.3.4 or >=4.0.0-alpha1 and <4.0.0 or <4.0.0 or >=3.3.0 and <3.3.4 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 4.0.0 |
| CVE-2021-27915 | Mautic vulnerable to stored cross-site scripting in description field | high | 7.6 | >=1.0.0-beta2 and <4.4.12 | 4.4.12 |
| CVE-2021-27912 | XSS vulnerability on asset view | high | 7.1 | <3.3.4 or >=4.0.0-alpha1 and <4.0.0 or <4.0.0 or >=3.3.0 and <3.3.4 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 4.0.0 |
| CVE-2022-25773 | Mautic allows Relative Path Traversal in assets file upload | medium | 4.3 | <5.2.3 | 5.2.3 |
| CVE-2022-25775 | Mautic SQL Injection in dynamic Reports | medium | 6.6 | >=2.14.1 and <4.4.12 or >=5.0.0-alpha and <5.0.4 | 4.4.12, 5.0.4 |
| CVE-2026-9559 | Mautic vulnerable to Path Traversal via Campaign Import | critical | 9.9 | >=7.0.0 and <7.1.2 | 7.1.2 |
| CVE-2026-9558 | Mautic has Server-Side Template Injection (SSTI) in Theme Templates | critical | 9.9 | >=1.3.0 or >=5.0.0 and <5.2.11 or >=6.0.0 and <6.0.9 or >=7.0.0 and <7.1.2 | – |
| CVE-2022-25769 | Improper regex in htaccess file | medium | 0.0 | <3.3.5 or >=4.0.0 and <4.2.0 | 3.3.5, 4.2.0 |
| CVE-2021-27913 | Use of a Broken or Risky Cryptographic Algorithm | low | 3.5 | <3.3.4 or >=4.0.0-alpha1 and <4.0.0 or <4.0.0 or >=3.3.0 and <3.3.4 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 4.0.0 |
| CVE-2022-25777 | Mautic: MST-48 Server-Side Request Forgery in Asset section | medium | 6.5 | >=1.0.0-beta4 and <4.4.12 or >=5.0.0-alpha and <5.0.4 | 4.4.12, 5.0.4 |
| CVE-2022-25776 | Mautic Sensitive Data Exposure due to inadequate user permission settings | high | 8.3 | >=1.0.2 and <4.4.12 or >=5.0.0-alpha and <5.0.4 | 4.4.12, 5.0.4 |
| CVE-2022-25774 | Mautic vulnerable to cross-site scripting in notifications via saving Dashboards | medium | 4.8 | <4.4.12 | 4.4.12 |
| CVE-2025-5257 | Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure | medium | 6.5 | >=4.0.0 and <4.4.16 or >=5.0.0-alpha and <5.2.6 or >=6.0.0-alpha and <6.0.2 | 4.4.16, 5.2.6, 6.0.2 |
| CVE-2021-27908 | Mautic vulnerable to secret data exfiltration via symfony parameters | medium | 5.8 | <3.3.2 or >=3.3.0 and <3.3.2 or >=3.2.0 and <3.3.0 or >=3.1.0 and <3.2.0 or <3.1.0 | 3.3.2 |
| CVE-2024-47059 | Mautic allows users enumeration due to weak password login | medium | 4.3 | >=5.1.0 and <5.1.1 | 5.1.1 |
| CVE-2026-3105 | Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting | high | 7.6 | >=2.10.0 and <5.2.10 or >=6.0.0-alpha and <6.0.8 or >=7.0.0-alpha and <7.0.1 | 5.2.10, 6.0.8, 7.0.1 |
| CVE-2024-47057 | Mautic allows user name enumeration due to response time difference on password reset form | medium | 5.3 | >=1.0.0 and <4.4.16 or >=5.0.0-alpha and <5.2.6 or >=6.0.0-alpha and <6.0.2 | 4.4.16, 5.2.6, 6.0.2 |
| CVE-2025-9823 | Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add | medium | 0.0 | >=4.4.0 and <4.4.17 or >=5.0.0-alpha and <5.2.8 or >=6.0.0-alpha and <6.0.5 | 4.4.17, 5.2.8, 6.0.5 |
| CVE-2024-47050 | Mautic vulnerable to XSS in contact/company tracking (no authentication) | medium | 5.4 | >=2.6.0 and <4.4.13 or >=5.0.0-alpha and <5.1.1 | 4.4.13, 5.1.1 |
| CVE-2025-9821 | Mautic vulnerable to SSRF via webhook function | low | 2.7 | >=4.4.0 and <4.4.17 or >=5.0.0-alpha and <5.2.8 or >=6.0.0-alpha and <6.0.5 | 4.4.17, 5.2.8, 6.0.5 |
| CVE-2021-27917 | Mautic has an XSS in contact tracking and page hits report | high | 7.3 | >=1.0.0-beta4 and <4.4.13 or >=5.0.0-alpha and <5.1.1 | 4.4.13, 5.1.1 |
| CVE-2022-25768 | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | >=1.1.3 and <4.4.13 or >=5.0.0-alpha and <5.1.1 | 4.4.13, 5.1.1 |
| CVE-2025-9824 | Mautic Vulnerable to User Enumeration via Response Timing | medium | 5.9 | >=4.4.0 and <4.4.17 or >=5.0.0-alpha and <5.2.8 or >=6.0.0-alpha and <6.0.5 | 4.4.17, 5.2.8, 6.0.5 |
| CVE-2022-25770 | Mautic has insufficient authentication in upgrade flow | high | 7.8 | >=1.0.0-beta3 and <4.4.13 or >=5.0.0-alpha and <5.1.1 | 4.4.13, 5.1.1 |
| CVE-2024-47055 | Mautic segment cloning doesn't have a proper permission check | medium | 4.3 | >=5.0.0-alpha and <5.2.6 or >=6.0.0-alpha and <6.0.2 | 5.2.6, 6.0.2 |
| CVE-2025-5256 | Mautic has an Open Redirect vulnerability on user unlock path. | medium | 5.4 | >=1.0.0 and <4.4.16 or >=5.0.0-alpha and <5.2.6 or >=6.0.0-alpha and <6.0.2 | 4.4.16, 5.2.6, 6.0.2 |
| CVE-2025-13828 | Mautic user without privileged access to the Marketplace can install and uninstall composer packages | critical | 0.0 | >=4.0.0 and <4.4.18 or >=5.0.0 and <5.2.9 or >=6.0.0 and <6.0.7 | 4.4.18, 5.2.9, 6.0.7 |
| CVE-2025-9822 | Mautic vulnerable to secret data extraction via elfinder | medium | 5.5 | >=4.4.0 and <4.4.17 or >=5.0.0-alpha and <5.2.8 or >=6.0.0-alpha and <6.0.5 | 4.4.17, 5.2.8, 6.0.5 |
| CVE-2026-4776 | Mautic has SQL Injection in API Contact Filtering | high | 7.1 | >=2.6.0 and <=4.4.13 or >=5.0.0 and <5.2.11 or >=6.0.0 and <6.0.9 or >=7.0.0 and <7.1.2 | 5.2.11, 6.0.9, 7.1.2 |
| CVE-2026-9809 | Mautic has Stored Cross-Site Scripting (XSS) in Projects Component | high | 7.6 | >=7.0.0 and <7.1.2 | 7.1.2 |
| CVE-2024-47058 | Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field) | medium | 4.8 | >=5.0.0-alpha and <5.1.1 or >=1.0.0-beta and <4.4.13 | 5.1.1, 4.4.13 |
| CVE-2026-9808 | Mautic has an Authorization Bypass in API v2 Endpoints | high | 7.1 | >=7.0.0 and <7.1.2 | 7.1.2 |
| CVE-2026-9811 | Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector | medium | 5.4 | >=7.0.0 and <7.1.2 | 7.1.2 |
| CVE-2026-9557 | Mautic Focus component Vulnerable to SSRF | medium | 6.4 | >=4.0.0 and <=4.4.13 or >=5.0.0 and <5.2.11 or >=6.0.0 and <6.0.9 or >=7.0.0 and <7.1.2 | 5.2.11, 6.0.9, 7.1.2 |
| CVE-2024-47056 | Mautic does not shield .env files from web traffic | medium | 5.1 | >=4.4.0 and <4.4.16 or >=5.0.0-alpha and <5.2.6 or >=6.0.0-alpha and <6.0.2 | 4.4.16, 5.2.6, 6.0.2 |
| CVE-2021-3142 | XSS in Mautic | high | 0.0 | >=3.0.0 and <3.2.4 or >=2.0.0 and <2.16.5 or >=3.2.0 and <3.2.4 or >=3.1.0 and <3.2.0 or >=3.0.0 and <3.1.0 | 3.2.4, 2.16.5 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked