CVE-2022-25776

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing.

Users could potentially access sensitive data such as names and surnames, company names and stage names.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-257776.5Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application dCVE-2022-257788.8Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in CVE-2022-257794.3Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This iCVE-2022-25789.8A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unCVE-2022-257804.3Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope.CVE-2022-257816.1Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged CVE-2022-257825.4Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update priviCVE-2022-257834.3Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. ThiCVE-2022-257844.8Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiCVE-2022-257857.2Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affectCVE-2022-257864.9Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. ThiCVE-2022-257876.7Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hij
CVE-2022-25776: Medium severity, CVSS 6.5 | Vulnix