CVE-2026-6956 | | | 2026-05-11 | ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary… |
CVE-2026-6909 | | | 2026-05-11 | ATutor is vulnerable to Reflected XSS in /install/upgrade.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary… |
CVE-2020-37147 | High | 7.1 | 2026-02-07 | ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through… |
CVE-2023-27008 | Medium | 6.1 | 2023-03-28 | A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web… |
CVE-2021-43498 | High | 7.5 | 2022-04-08 | An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters a… |
CVE-2020-23341 | Medium | 6.1 | 2021-08-17 | A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2020-10557 | High | 8.8 | 2020-03-16 | An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file… |
CVE-2015-1583 | High | 8.8 | 2020-03-02 | Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests tha… |
CVE-2014-9753 | Critical | 9.8 | 2020-02-11 | confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. |
CVE-2019-16114 | Critical | 9.8 | 2019-09-09 | In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to t… |
CVE-2019-12169 | High | 8.8 | 2019-06-03 | ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/la… |
CVE-2019-12170 | High | 8.8 | 2019-05-17 | ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command ex… |
CVE-2019-11446 | High | 8.8 | 2019-04-22 | An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in… |
CVE-2019-7172 | Medium | 6.1 | 2019-01-29 | A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users… |
CVE-2015-6521 | Medium | 5.4 | 2017-10-10 | Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2. |
CVE-2017-14981 | Medium | 5.4 | 2017-10-03 | Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_f… |
CVE-2015-7711 | Medium | 6.1 | 2017-08-31 | Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the h pa… |
CVE-2016-10400 | High | 7.5 | 2017-07-22 | Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary fil… |
CVE-2017-1000004 | Critical | 9.8 | 2017-07-17 | ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Cou… |
CVE-2017-1000003 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege… |
CVE-2017-1000002 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution… |
CVE-2016-2555 | Critical | 9.8 | 2017-04-13 | SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriend… |
CVE-2017-6483 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data pass… |
CVE-2016-2539 | High | 8.8 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for… |
CVE-2015-7712 | | | 2015-11-16 | Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_… |
CVE-2014-9752 | | | 2015-11-16 | Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute ar… |
CVE-2014-2091 | | | 2014-03-02 | Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbi… |
CVE-2012-6528 | | | 2013-01-31 | Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)… |
CVE-2012-5454 | | | 2012-10-22 | user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary use… |
CVE-2012-5453 | | | 2012-10-22 | SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands… |
CVE-2012-5169 | | | 2012-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary… |
CVE-2012-5168 | | | 2012-10-22 | ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_… |
CVE-2012-5167 | | | 2012-10-22 | Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to… |
CVE-2011-3706 | | | 2011-09-23 | ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message… |
CVE-2010-3455 | | | 2010-09-17 | Cross-site scripting (XSS) vulnerability in index.php in AChecker 1.0 allows remote attackers to inject arbitrary web script or HTML via the uri parameter. |
CVE-2009-4945 | | | 2010-07-22 | AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via requests to index.php. |
CVE-2009-4944 | | | 2010-07-22 | Multiple cross-site scripting (XSS) vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) address param… |
CVE-2009-4942 | | | 2010-07-22 | Cross-site request forgery (CSRF) vulnerability in ACollab 1.2 allows remote attackers to hijack the authentication of arbitrary users for requests that add pe… |
CVE-2009-4941 | | | 2010-07-22 | Cross-site scripting (XSS) vulnerability in sign_in.php in ATRC ACollab 1.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter. |
CVE-2010-0971 | | | 2010-03-16 | Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web scrip… |
CVE-2008-3368 | | | 2008-07-30 | PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbi… |
CVE-2008-0828 | | | 2008-02-19 | Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) attribute… |