Servers and applications
CVE-2020-35125
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE-2020-35124, but also related to the Referer concept).
- Severity
- Critical 9.6
- Published
- 9 Feb 2021
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.16.5, 3.2.4
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MauticServers and applications · cpe:a:acquia:mautic |
|