CVE-2024-47058

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Mautic	Mautic	>= >= 1.0.0, < < 4.4.13; >= >= 5.0.0, < < 5.1.1

References

https://github.com/mautic/mautic/security/advisories/GHSA-xv68-rrmw-9xwfVendor Advisory

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-470594.3When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. CVE-2024-47066.4The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'CVE-2024-470606.5Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respecti CVE-2024-470618.3Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longsta CVE-2024-470628.8Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL querie CVE-2024-470636.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with CVE-2024-470646.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a log CVE-2024-470656.5Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given CVE-2024-470668.8Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection impleme CVE-2024-470676.1AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. Th CVE-2024-470686.1Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability wh CVE-2024-470696.1Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the websit