CVE-2011-1405
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users...
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
- Record
CVE-2011-1405- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
- Record
CVE-2011-1405- Updated
- 2026-11-02
EUVDEUVD-2011-1412 No score
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
- Record
EUVD-2011-1412- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9rcm-4wjg-wvhc No score
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users...
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
- Record
GHSA-9rcm-4wjg-wvhc- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
maharaDebian:5.0 |
before 1.0.4-4+lenny10, plus listed versions 1.0.4-41.0.4-4+lenny11.0.4-4+lenny21.0.4-4+lenny31.0.4-4+lenny4 Show 4 moreShow less1.0.4-4+lenny51.0.4-4+lenny61.0.4-4+lenny71.0.4-4+lenny8 |
1.0.4-4+lenny10 |
maharaDebian:6.0 |
before 1.2.6-2+squeeze2, plus listed versions 1.2.6-21.2.6-2+squeeze1 |
1.2.6-2+squeeze2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1405 is a low vulnerability (CVSS 3.5) in Mahara, published May 13, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in mahara 1.0.4-4+lenny10.