CVE-2009-0660

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-03-11 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a (1) profile and (2) blog, a different vulnerability than CVE-2009-0487.

Affected products

mahara: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+15)

References

http://mahara.org/interaction/forum/topic.php?id=350
http://secunia.com/advisories/34222
http://secunia.com/advisories/34231
http://wiki.mahara.org/Release_Notes/1.1.2
http://www.debian.org/security/2009/dsa-1736
http://www.securityfocus.com/bid/34064
http://www.vupen.com/english/advisories/2009/0665
https://exchange.xforce.ibmcloud.com/vulnerabilities/49168
http://mahara.org/interaction/forum/topic.php?id=350
http://secunia.com/advisories/34222
http://secunia.com/advisories/34231
http://wiki.mahara.org/Release_Notes/1.1.2

Get alerted when CVE-2009-0660 or the next vulnerability affects your stack