Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via…

Description

Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) themes/default/tile_search/index.tmpl.php, (2) login.php, (3) search.php, (4) password_reminder.php, (5) login.php/jscripts/infusion, (6) login.php/mods/_standard/flowplayer, (7) browse.php/jscripts/infusion/framework/fss, (8) registration.php/themes/default/ie_styles.css, (9) about.php, or (10) themes/default/social/basic_profile.tmpl.php.

Scores

EPSS (exploitation in 30 days)

1.9% · top 21% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• n/a
• CWE-79 (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (6)

• 51423 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• atutor-multiplescripts-xss(72412) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20120115 ATutor 2.0.3 Multiple XSS vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://atutor.ca/atutor/change_log.php (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.darksecurity.de/advisories/2012/SSCHADV2012-002.txt (opens in a new tab)x_refsource_MISCx_transferred
• 47597 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 6 Aug 2024, 21:28 UTC.