Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-9809

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:49e8b69ba8457f26d832a37bc2d6251e3d824032d3133ce4cf70db31db36cbc3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageName":"mautic/core","repo":"https://github.com/mautic/mautic","versions":[{"lessThan":"7.1.2","status":"affected","version":"7.0.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:3844e738900d98a387ba84790e37fa3c77a50918d18810bc4413707e3caba24e · sha256:030851d385a08847… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:3844e738900d98a387ba84790e37fa3c77a50918d18810bc4413707e3caba24e · sha256:030851d385a08847… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:3844e738900d98a387ba84790e37fa3c77a50918d18810bc4413707e3caba24e · sha256:030851d385a08847… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-7h65-whp7-rgqf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:3844e738900d98a387ba84790e37fa3c77a50918d18810bc4413707e3caba24e · sha256:030851d385a08847… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer