CVE-2013-4430: Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7....

Security readout for executives and security teams

CVE-2013-4430 is a cross-site scripting issue in older Mahara releases. A remote attacker could abuse the HTTP Host header to inject script or HTML through lib/web.php. The sources identify fixed releases, but do not provide CVSS scoring or evidence of active exploitation. Exposure is likely limited to organizations still running affected Mahara versions, especially internet-accessible learning portfolio sites. Current source data lists no generic vendor/product CPEs beyond Mahara and gives no evidence about hosted-service exposure. Treat as a moderate legacy web application risk. Patch any remaining affected Mahara systems, especially public sites, but do not assume active exploitation from the provided evidence. Mitigation focus: Upgrade Mahara to 1.5.12, 1.6.7, 1.7.3, or later as applicable.; Confirm the target release is supported by current Mahara guidance.; Prioritize remediation for internet-facing Mahara deployments..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.