Vulnerabilities

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php.

ATutor is vulnerable to Reflected XSS in restore functionality.

ATutor is vulnerable to Stored Cross Site Scripting in registration functionality.

ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints.

ATutor is vulnerable to Server-Side request forgery in import functionalities.

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory.

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality.

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints.

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality.

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled.

ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality.

ATutor is vulnerable to authentication bypass .

ATutor Gameme module allows users to upload files of any type and extension without restriction.

ATutor is vulnerable to Reflected XSS in /install/install.php endpoint.

ATutor is vulnerable to Reflected XSS in /install/upgrade.php endpoint.

ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the 'id' parameter.

A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.

An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.

A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

An issue was discovered in AContent through 1.4.

Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_…

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application.

ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods…

ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component.