Mahara Mahara
108 CVEs affecting Mahara Mahara. Latest disclosed: 2025-08-26. Critical: 8, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45134 | Critical | 9.8 | 2025-08-22 | Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML… |
CVE-2022-44544 | Critical | 9.8 | 2022-11-06 | Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if t… |
CVE-2021-40849 | Critical | 9.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, res… |
CVE-2017-1000154 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in… |
CVE-2017-1000153 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent… |
CVE-2017-1000152 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the s… |
CVE-2024-39335 | Critical | 9.1 | 2025-08-26 | Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under… |
CVE-2012-2239 | Critical | 9.1 | 2012-11-24 | Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) inj… |
CVE-2024-47853 | High | 8.8 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning T… |
CVE-2022-28892 | High | 8.8 | 2022-04-28 | Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessa… |
CVE-2017-1000150 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the s… |
CVE-2017-1000148 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML thr… |
CVE-2017-14163 | High | 8.8 | 2017-10-31 | An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without lo… |
CVE-2017-1000134 | High | 8.1 | 2017-11-03 | Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group… |
CVE-2017-1000139 | High | 8.0 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all p… |
CVE-2021-40848 | High | 7.8 | 2021-11-03 | In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, l… |
CVE-2025-29992 | High | 7.5 | 2025-08-26 | Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or t… |
CVE-2023-47799 | High | 7.5 | 2025-08-25 | Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or vi… |
CVE-2022-42707 | High | 7.5 | 2022-11-06 | In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permi… |
CVE-2022-33913 | High | 7.5 | 2022-06-20 | In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check. |