CVE-2022-25775CWE-89
SQL Injection in dynamic Reports
Medium · published September 18, 2024
What it is
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.
The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
The record
Technical detail
- CVSS v3.1
- 6.6 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00593 · 47.7th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2024-09-18T15:01Z
EPSS history
Timeline