CVE-2026-64972 - Reflected XSS in ATutor · CoreCVE

Back Back to CVE browser

MEDIUM

Reflected XSS in ATutor

Published Aug 20, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related preview_top.php file sanitises these parameters, but that does not prevent XSS in the parent frameset rendered by preview.php itself.

Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Affected products

Vendor ATutor Product ATutor Default
n/a
- Version
  2.2.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
2.2.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://atutor.github.io/
product
https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory

Link	Providers	Tags
https://atutor.github.io/		product
https://cert.pl/en/posts/2026/08/CVE-2026-64960		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CERT-PL

Published Aug 20, 2026

Updated Aug 20, 2026

Reserved Jul 21, 2026

Link CVE-2026-64972

CISA Vulnrichment

Updated Aug 20, 2026

Status Deferred

Modified Aug 28, 2026

Link CVE-2026-64972

Severity n/a

Public date n/a

Links CVE-2026-64972

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a