CVE-2026-64971: Reflected XSS in ATutor

Published Aug 20, 2026

Updated

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Affected Software

1 affected component

ATutor=2.2.4

Event History

Aug 20, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to craft a malicious URL targeting the restore functionality and persuade a victim to open it. Opening the URL can cause arbitrary JavaScript to execute in the victim's browser.

Which versions are confirmed affected?

Only ATutor version 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be vulnerable.

Is a patch available?

No fix is identified in the available information. The product is no longer actively supported, and the vulnerabilities have not been fixed.