CVE-2017-17454

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.

• CWE-79

• https://bugs.launchpad.net/mahara/+bug/1732987Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=8149Vendor Advisory
• https://reviews.mahara.org/#/c/8191/Vendor Advisory
• https://bugs.launchpad.net/mahara/+bug/1732987Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=8149Vendor Advisory
• https://reviews.mahara.org/#/c/8191/Vendor Advisory

Published

Feb 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17443OPC Foundation Local Discovery Server (LDS) 1.03.370 require…
• CVE-2017-17446The Mem_File_Reader::read_avail function in Data_Reader.cpp …
• CVE-2017-17448net/netfilter/nfnetlink_cthelper.c in the Linux kernel throu…
• CVE-2017-17449The __netlink_deliver_tap_skb function in net/netlink/af_net…
• CVE-2017-17450net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 do…
• CVE-2017-17451The WP Mailster plugin before 1.5.5 for WordPress has XSS in…
• CVE-2017-17455Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10…
• CVE-2017-17456Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-17457Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-17458In Mercurial before 4.4.1, it is possible that a specially m…
• CVE-2017-17459http_transport.c in Fossil before 2.4, when the SSH sync pro…
• CVE-2017-1746IBM Jazz for Service Management (IBM Tivoli Components 1.1.3…