description: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.
problem types: Cross-Site Scripting
affected:
{
product: mahara
vendor: mahara
versions:
status: affected, version: 1.5.9
}