Packagist/mautic/core-lib — 5 CVEs

HIGH7.8CVE-2022-25770Mautic has insufficient authentication in upgrade flow

>= 1.0.0-beta3, < 4.4.13

HIGH7.3CVE-2021-27917Mautic has an XSS in contact tracking and page hits report

>= 1.0.0-beta4, < 4.4.13

HIGH7.0CVE-2022-25768Mautic vulnerable to Improper Access Control in UI upgrade process

>= 1.1.3, < 4.4.13

MEDIUM5.4Mautic vulnerable to XSS in contact/company tracking (no authentication)

>= 2.6.0, < 4.4.13

MEDIUM4.8Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)

>= 5.0.0-alpha, < 5.1.1

pkg:Packagist/mautic/core-lib