{"items":[{"id":"NVI-00007260","kind":"vulnerability","title":"Stored XSS vulnerability on Bounce Management Callback","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-86pv-95mj-7w5f","CVE-2021-27910"],"plain_summary":"OSV carries this publisher advisory for mautic/core, mautic/core. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.3.4 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.0.0 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2f6099394e845e115152f3a8840d0795"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T03:45:36.010Z","value":"4.3 MEDIUM (2.0)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-7ec564e92e339513cf5ad230a440b078"},{"kind":"CVSS","as_of":"2026-06-17T03:45:36.010Z","value":"8.2 HIGH (3.1)","meaning":"security@mautic.org severity; no combined Null risk score.","source_id":"sr-7ec564e92e339513cf5ad230a440b078"},{"kind":"CVSS","as_of":"2026-06-17T03:45:36.010Z","value":"6.1 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-7ec564e92e339513cf5ad230a440b078"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.699%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.53157. Missing scores are unknown.","source_id":"sr-2f6099394e845e115152f3a8840d0795"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d541f75e0bfea5bec08852e0eff5e357","url":"https://github.com/advisories/GHSA-86pv-95mj-7w5f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-86pv-95mj-7w5f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.958Z"},{"id":"sr-7ec564e92e339513cf5ad230a440b078","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27910","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2021-27910","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T23:13:08.840Z"},{"id":"sr-2f6099394e845e115152f3a8840d0795","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2021-27910","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.3.4"]},{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-alpha1; fixed 4.0.0"]}],"null_published_at":"2026-11-03T17:49:21.349Z","source_updated_at":"2026-07-08T06:30:02.579Z","source_disclosed_at":"2021-09-01T18:40:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:59.958Z"},{"id":"NVI-00007260","kind":"vulnerability","title":"Stored XSS vulnerability on Bounce Management Callback","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-86pv-95mj-7w5f","CVE-2021-27910"],"plain_summary":"OSV carries this publisher advisory for mautic/core, mautic/core. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.3.4 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.0.0 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2f6099394e845e115152f3a8840d0795"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.699%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.53157. Missing scores are unknown.","source_id":"sr-2f6099394e845e115152f3a8840d0795"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d541f75e0bfea5bec08852e0eff5e357","url":"https://github.com/advisories/GHSA-86pv-95mj-7w5f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-86pv-95mj-7w5f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.958Z"},{"id":"sr-2f6099394e845e115152f3a8840d0795","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2021-27910","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.3.4"]},{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-alpha1; fixed 4.0.0"]}],"null_published_at":"2026-10-31T22:27:15.281Z","source_updated_at":"2026-07-08T06:30:02.579Z","source_disclosed_at":"2021-09-01T18:40:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:59.958Z"},{"id":"NVI-00007260","kind":"vulnerability","title":"Stored XSS vulnerability on Bounce Management Callback","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-86pv-95mj-7w5f","CVE-2021-27910"],"plain_summary":"OSV carries this publisher advisory for mautic/core, mautic/core. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.3.4 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.0.0 for mautic/core. Confirm the publisher’s latest guidance.","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d541f75e0bfea5bec08852e0eff5e357","url":"https://github.com/advisories/GHSA-86pv-95mj-7w5f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-86pv-95mj-7w5f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.958Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.3.4"]},{"certainty":"source_listed","source_ids":["sr-d541f75e0bfea5bec08852e0eff5e357"],"technology":"mautic/core","known_exclusions":[],"conditions_summary":"### Impact\nInsufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the \"error\" and \"error_related_to\" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.\n\nAn attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the \"error\" and \"error_related_to\" parameters of the POST request (POST /mailer//callback). It is noted that there is no authentication needed to access this function.\n\nThe JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.\n\n### Patches\nUpgrade to 3.3.4 or 4.0.0\n\n### Workarounds\nNo\n\n### References\nhttps://github.com/mautic/mautic/releases/tag/3.3.4\nhttps://github.com/maut","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-alpha1; fixed 4.0.0"]}],"null_published_at":"2026-10-31T22:13:14.319Z","source_updated_at":"2026-07-08T06:30:02.579Z","source_disclosed_at":"2021-09-01T18:40:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:59.958Z"}],"next_cursor":null,"snapshot_revision":"42594"}