CVE-2018-11565

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.

• CWE-200

• https://bugs.launchpad.net/mahara/+bug/1772774Issue Tracking, Patch, Vendor Advisory
• https://mahara.org/interaction/forum/topic.php?id=8271Vendor Advisory
• https://bugs.launchpad.net/mahara/+bug/1772774Issue Tracking, Patch, Vendor Advisory
• https://mahara.org/interaction/forum/topic.php?id=8271Vendor Advisory

Published

May 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1156Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to …
• CVE-2018-11560The webService binary on Insteon HD IP Camera White 2864-222…9.8
• CVE-2018-11561An integer overflow in the unprotected distributeToken funct…7.5
• CVE-2018-11562An issue was discovered in MISP 2.4.91. A vulnerability in a…
• CVE-2018-11563An issue was discovered in Open Ticket Request System (OTRS)…4.6
• CVE-2018-11564Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a u…
• CVE-2018-11567Prior to 2018-04-27, the reprompt feature in Amazon Echo dev…
• CVE-2018-11568Reflected XSS is possible in the GamePlan theme through 1.5.…
• CVE-2018-11569Controller/ListController.php in Eventum 3.5.0 is vulnerable…
• CVE-2018-1157Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to …
• CVE-2018-11571ClipperCMS 1.3.3 allows Session Fixation.
• CVE-2018-11572ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Mo…