An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.
A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
Kameleo versions up to 5.0.1.19 contain a server-side request forgery (SSRF) vulnerability in the InternalController.TestProxy function of the Proxy Validation component. This vulnerability allows remote attackers to manipulate host and port arguments to induce SSRF. The issue is addressed in version 5.2.0, where the vulnerable route was removed and replaced.
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these segment filter or custom field properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data, for example during segment evaluation, contact export, or custom field API requests. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute arbitrary code on the server, read, modify, or delete data stored in the Mautic instance, including contact data, and affect its availability. Exploitation requires high privileges or an existing ability to write to the affected stored data.
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. An authenticated user with the core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in execution of arbitrary code on the server with the privileges of the web server process. This allows the attacker to execute operating system commands, read server-side files including configuration files and database credentials, write files, and reach internal services. In default installations the core:themes:create permission is granted to the Administrator role, and in multi-operator setups it may be delegated to other roles. This is an incomplete fix for GHSA-9fx4-7cmj-47vg.
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
CVE-2026-116275 is a code injection vulnerability in AllenAI AllenNLP versions 2.10.0 and 2.10.1. It affects the Registrable.resolve_class_name function in the Registrable Configuration Machinery component. The vulnerability allows remote attackers to perform code injection by manipulating the argument Type. The exploit code has been publicly disclosed. The affected versions are no longer supported by the vendor.
Frappe CRM versions before 1.89.1 have a missing authorization vulnerability in the get_contact_by_phone_number API. This flaw allows authenticated users with low privileges to query CRM Lead records they should not access by supplying a phone number, bypassing normal permission checks. The vulnerability leads to unauthorized disclosure of sensitive CRM lead data.
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
CVE-2026-116274 is an improper authorization vulnerability in JIZHICMS versions 2.5.0 through 2.5.6. It affects the Pay function in the app/home/c/OrderController.php file, allowing remote attackers to manipulate the orderno argument to bypass authorization controls. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or issued a patch.
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.
CVE-2026-115720 is a server-side request forgery (SSRF) vulnerability in Frappe Builder versions before 1.36.1. The flaw exists in builder/api.py where the URL validation only checks the initial hostname but does not handle HTTP redirects properly, allowing attackers to redirect requests to internal or link-local addresses. An authenticated attacker can exploit this by calling the convert_to_webp endpoint, which lacks permission checks, to perform SSRF attacks, internal port scanning, or cause denial of service due to request hangs.
CVE-2026-116263 is a race condition vulnerability in HaschekSolutions PictShare versions 3.7.0 and 3.7.1, specifically in the function architect within src/inc/core.php related to file upload handling. The flaw can be exploited remotely but requires high attack complexity and is difficult to exploit. A public exploit exists. Upgrading to version 3.7.2 resolves the issue.
Dutch police arrested two individuals involved in a bank helpdesk fraud scheme that used NFC relay attacks to steal over $400,000 from 170 victims. The suspects called victims, played AI-generated audio impersonating banks, and persuaded them to install an app to scan their credit cards via NFC. The stolen card data was then used to withdraw money from victims' accounts at ATMs. The suspects were arrested and their infrastructure seized.
CVE-2026-105947 is a path traversal vulnerability in Innotim Software's Logsign SIEM affecting versions from 6.4.120 up to but not including 6.4.122. This flaw allows an attacker with low privileges to access files outside the intended directory, potentially leading to unauthorized disclosure of sensitive information. The vulnerability has been assigned a CVSS 3.1 score of 6.5, indicating medium severity. A fix is available in version 6.4.122.