Vulnerabilities > Acquia

DATE CVE VULNERABILITY TITLE RISK
2024-09-18 CVE-2021-27917 Cross-site Scripting vulnerability in Acquia Mautic
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
network
low complexity
acquia CWE-79
5.4
2024-09-18 CVE-2024-47050 Cross-site Scripting vulnerability in Acquia Mautic
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
network
low complexity
acquia CWE-79
6.1
2024-09-18 CVE-2024-47058 Cross-site Scripting vulnerability in Acquia Mautic
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed.
network
low complexity
acquia CWE-79
4.8
2024-09-18 CVE-2022-25774 Cross-site Scripting vulnerability in Acquia Mautic
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards.
network
low complexity
acquia CWE-79
5.4
2024-09-18 CVE-2022-25775 SQL Injection vulnerability in Acquia Mautic
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
network
low complexity
acquia CWE-89
7.2
2024-09-18 CVE-2022-25776 Incorrect Default Permissions vulnerability in Acquia Mautic
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.
network
low complexity
acquia CWE-276
6.5
2024-09-17 CVE-2021-27916 Path Traversal vulnerability in Acquia Mautic
Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion.
network
low complexity
acquia CWE-22
8.1
2024-09-17 CVE-2021-27915 Cross-site Scripting vulnerability in Acquia Mautic
Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions. This could lead to the user having elevated access to the system.
network
low complexity
acquia CWE-79
critical
9.0
2022-06-20 CVE-2022-25772 Cross-site Scripting vulnerability in Acquia Mautic
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript
network
low complexity
acquia CWE-79
6.1
2022-06-01 CVE-2021-27914 Cross-site Scripting vulnerability in Acquia Mautic
A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript
network
acquia CWE-79
3.5