CVE-2025-61872

MEDIUM

Mahara < 25.04.2 and 24.04.11 - Cross-Site Scripting via Elasticsearch7 Query Parameter

Title source: llm

Description

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter.

References (2)

Core 2

Core References

https://mahara.org

https://mahara.org/interaction/forum/topic.php?id=9851

Scores

CVSS v3 6.1

EPSS 0.0019

EPSS Percentile 9.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Published Apr 24, 2026

Tracked Since Apr 24, 2026