CVE-2026-64969

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64971 Reflected XSS in ATutor

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

CVE-2026-64970 Stored XSS in ATutor

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

EUVD-2026-63370

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64967

ATutor's error log viewer contains a path traversal flaw allowing an admin to read arbitrary files outside the logs directory. Version 2.2.4 is confirmed vulnerable; the product is no longer supported and no fix exists, so migration to a maintained alternative is the only remediation. Exploitatio...

EUVD-2026-63368

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is...

CVE-2026-64964 Generation of Predictable Email Confirmation Token in ATutor

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

CVE-2026-64963 Path Traversal in ATutor

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

DRUPAL-CONTRIB-2026-102

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

CVE-2026-74355

A flaw was found in the Linux kernel's iommu/vt-d component. This vulnerability occurs when the info-node RB-tree member is zero-initialized, and a device that does not support Address Translation Services ATS skips the devicerbtreeinsert call. If a subsequent probe step fails, the error path...

CVE-2026-19841 TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission

A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degree of complexity is needed for the...

EUVD-2026-58718

A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degree of complexity is needed for the...

CVE-2026-19841

CVE-2026-19841 affects TRENDNET TEW-813DRU running 1.01b01. The flaw involves an unknown function of the component vsftpd, specifically the file /etc/vsftpd.conf, causing incorrect default permissions. The attack is described as remote and requires a high degree of complexity to succeed. Exploita...

CVE-2026-19830

A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMITGLOBAL results in allocation of resources. It is possible to launch the attack remotely...

CVE-2026-19830 TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources

A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMITGLOBAL results in allocation of resources. It is possible to launch the attack remotely...

PT-2026-72053

A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes incorrect default permissions. The attack is possible to be carried out remotely. A high degree of complexity is needed for the...