CVE-2026-71245
Published Aug 5, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
Red Hat CNA-LR concluded that this CVE is not valid.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
No reference.
History
Aug 17, 2026 2:30 PM
Title updated. Weaknesses updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Mautic - SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint | |
| Weaknesses | CWE-89 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Aug 17, 2026 2:15 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter. | Red Hat CNA-LR concluded that this CVE is not valid. |
Aug 10, 2026 12:00 PM
Description updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks. | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter. |
Aug 10, 2026 11:30 AM
Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint | Mautic - SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint |
Aug 5, 2026 2:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Aug 5, 2026 12:45 PM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Mautic
Mautic mautic |
|
| Vendors & Products |
Mautic
Mautic mautic |
Aug 5, 2026 11:15 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks. | |
| Title | Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
Weaknesses
No weakness.
