25 matches found
CVE-2026-6956
ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported. Maintainers of this project were notified early...
CVE-2016-10400
Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/core/courses/users/createcourse.php. The attacker can read an arbitrary file by visiting getcourseicon.php?id= after the traversal attack...
CVE-2019-11446
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase a...
CVE-2020-23341
A reflected cross site scripting XSS vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2019-16114
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...
EUVD-2017-6457
Malware in sbrugna...
EUVD-2017-15540
Malware in sbrugna...
EUVD-2005-2650
Malware in sbrugna...
EUVD-2016-1582
Malware in sbrugna...
EUVD-2014-9559
Malware in sbrugna...
EUVD-2014-2131
Malware in sbrugna...
EUVD-2015-7612
Malware in sbrugna...
EUVD-2017-1341
Malware in sbrugna...
EUVD-2017-1340
Malware in sbrugna...
EUVD-2014-9558
Malware in sbrugna...
EUVD-2019-16717
Malware in sbrugna...
EUVD-2005-2955
Malware in sbrugna...
EUVD-2005-2954
Malware in sbrugna...
EUVD-2019-3121
Malware in sbrugna...
CVE-2023-27008
A Cross-site scripting XSS vulnerability in the function encryptpassword in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...