CVE-2025-59308

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role...

Mahara 跨站脚本漏洞

Mahara is a free, open-source web-based electronic portfolio management system. Versions of Mahara prior to 25.04.2 and 24.04.11 contained a cross-site scripting vulnerability. This vulnerability stemmed from the Elasticsearch 7 search plugin not properly cleaning input parameters in queries, whi...

CVE-2025-59308

In Mahara, versions before 24.04.10 and 25 before 25.04.1 allow an institution administrator or institution support administrator on a multi-tenant site to masquerade as an institution member in another institution if they also hold the 'Site staff' role. This is the core vulnerability described ...

CVE-2025-59308

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role...

EUVD-2011-2745

Malware in sbrugna...

EUVD-2009-0666

Malware in sbrugna...

EUVD-2010-3849

Malware in sbrugna...

EUVD-2011-3601

Malware in sbrugna...

EUVD-2011-1410

Malware in sbrugna...

EUVD-2011-0464

Malware in sbrugna...

EUVD-2012-2246

Malware in sbrugna...

EUVD-2012-2240

Malware in sbrugna...

EUVD-2013-4307

Malware in sbrugna...

EUVD-2024-54911

Malicious code in bioql PyPI...

EUVD-2024-54912

Malicious code in bioql PyPI...

CVE-2024-45753

In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute...

Mahara < 22.10.6, 23.04.6, 24.04.1 XSS Vulnerability

Mahara is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if...

Mahara 24.04 < 24.04.2, 23.04 < 23.04.7 XSS Vulnerability

Mahara is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if...

CVE-2024-35203

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting XSS via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system...

CVE-2024-35203

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting XSS via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system...