Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in (a) indexlist.php and (2) year, (3) month, and (4) day parameter in (b) registration.php.

Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) showcourses or (2) currentcat parameters to (a) admin/createcourse.php, showcourses parameter to (b) users/createcourse.php, (3) p parameter to (c) documentation/admin/, (4) forgot parameter to (d) passwordreminder.php, (5) cat parameter to (e) users/browse.php, or the (6) submit parameter to admin/fixcontent.php.

registration.PHP in ATutor 1.5.1 pl2 allows remote attackers to execute arbitrary SQL commands via an e-mail address that ends in a NULL character, which bypasses the PHP regular expression check. NOTE: it is possible that this is actually a bug in PHP code, in which case this should not be treated as a vulnerability in ATutor.