HIGH
CVE-2026-71245
CVSS
7.1
Description
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter.
Weakness (CWE)
CWE-89
SQL Injection
EPSS Score
0.2%
Probability of exploitation in next 30 days
9.8th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.