CVE-2021-43498: Weak Password Recovery Mechanism for Forgotten Password

An Access Control vulnerability exists in ATutor 2.2.4 in passwordreminder.php when the g, id, h, formpasswordhidden, and formchange HTTP POST parameters are set...

ATutor 2.2.1 Directory Traversal / Remote Code Execution

This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP setup with displayerrors set to On, which can be used to allow us to upload a malicious ZIP file. On the web application, a blacklist verification is performed before extraction, however it is not sufficient to...

CVE-2006-3484: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 showcourses or 2 currentcat parameters to a admin/createcourse.php, showcourses parameter to b users/createcourse.php, 3 p parameter to c...

CVE-2005-2954: Undefined Security Weakness

SQL injection vulnerability in passwordreminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands via the email field...

ATutor 1.5.1 - password_reminder.php SQL Injection

ATutor 1.5.1 - passwordreminder.php SQL Injection source: https://www.securityfocus.com/bid/14831/info ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...