CVE-2020-24617: Mailtrain

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.

Affected products

• Mailtrain Mailtrain: up to and including 1.24.1

Published 2021-02-19. Last modified 2026-06-17.