CVE-2026-64970: Stored XSS in ATutor
ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone value without output encoding and the browser executes the payload leading to the theft of user's session cookie.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed?
An attacker only needs to register an account and place a JavaScript payload in the phone field. Any authenticated user who visits that attacker's public profile can have the payload execute in their browser.
What is the likely impact if exploitation succeeds?
The payload can steal the session cookie of an authenticated user viewing the malicious profile, potentially allowing the attacker to use that user's session.
Is a fix available, and what can be done if patching is not possible?
The product is no longer actively supported and the vulnerability has not been fixed. As an interim measure, restrict or disable public profile access and account registration where feasible, since those functions are part of the described attack path.
Which versions are confirmed affected?
Only ATutor 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be affected.