CVE-2025-61872

MEDIUM EPSS 9.1%

Published Apr 24, 20262mo ago · Modified Jun 17, 20261w ago

6.1 CVSS 3.1

Medium

Published Apr 24, 2026 2mo ago

Last Modified Jun 17, 2026 1w ago

Description

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter.

CVSS Details

Base Score

6.1

Exploitability

2.8

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

9.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 2

mahara.org https://mahara.org
mahara.org https://mahara.org/interaction/forum/topic.php?id=9851

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.