CVE-2019-9709

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user.

• CWE-79

• https://bugs.launchpad.net/bugs/1819547Issue Tracking, Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=8446Vendor Advisory
• https://bugs.launchpad.net/bugs/1819547Issue Tracking, Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=8446Vendor Advisory

Published

May 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9702Symantec Endpoint Encryption, prior to SEE 11.3.0, may be su…
• CVE-2019-9703Symantec Endpoint Encryption, prior to SEE 11.3.0, may be su…
• CVE-2019-9704Vixie Cron before the 3.0pl1-133 Debian package allows local…5.5
• CVE-2019-9705Vixie Cron before the 3.0pl1-133 Debian package allows local…5.5
• CVE-2019-9706Vixie Cron before the 3.0pl1-133 Debian package allows local…5.5
• CVE-2019-9708An issue was discovered in Mahara 17.10 before 17.10.8, 18.0…
• CVE-2019-9710An issue was discovered in webargs before 5.1.3, as used wit…
• CVE-2019-9711An issue was discovered in Joomla! before 3.9.4. The item_ti…
• CVE-2019-9712An issue was discovered in Joomla! before 3.9.4. The JSON ha…
• CVE-2019-9713An issue was discovered in Joomla! before 3.9.4. The sample …
• CVE-2019-9714An issue was discovered in Joomla! before 3.9.4. The media f…
• CVE-2019-9717In Libav 12.3, a denial of service in the subtitle decoder a…6.5