ATutor CVE-2026-6956

Q: What is the CVSS score of CVE-2026-6956?

CVE-2026-6956 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29049 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 CERT-PL

GHSA-mv66-6hmr-f6wq

XSS PHP

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 10:32 vuln.today

CVSS changed

May 11, 2026 - 10:22 NVD

5.1 (MEDIUM)

CVE Published

May 11, 2026 - 09:40 nvd

MEDIUM 5.1

DescriptionCVE.org

ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

Product is no longer actively supported. Maintainers of this project were notified early about this vulnerability, but did not respond with the details of the vulnerability or vulnerable version range. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

AnalysisAI

Reflected XSS in ATutor's /install/install.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Version 2.2.4 is confirmed vulnerable; the product is no longer actively maintained and vendor response to disclosure was unsuccessful, leaving no official patch available.

Technical ContextAI

ATutor is a web-based learning management system built in PHP. The vulnerability exists in the installation script endpoint /install/install.php, which processes user-supplied input without proper sanitization or output encoding. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where attacker-controlled data is reflected in HTTP responses and executed as JavaScript in the victim's browser context. This is a classic reflected XSS vulnerability requiring no authentication and minimal attack complexity, triggered only when a user clicks a malicious link.

RemediationAI

No vendor-released patch is available due to the product reaching end-of-life and maintainer non-response. Organizations running ATutor should consider migration to actively maintained learning management system alternatives such as Moodle, Canvas, or Blackboard. Immediate compensating controls include: (1) restrict network access to the /install/install.php endpoint using firewall rules or web server configuration to allow access only from trusted administrator IP ranges, preventing external attackers from reaching the vulnerable endpoint; (2) remove or rename the entire /install/ directory if installation is complete and the application is deployed, as the installation script should not be accessible in production; (3) implement Content Security Policy (CSP) headers to restrict JavaScript execution scope and mitigate XSS impact if the endpoint remains accessible; (4) deploy a Web Application Firewall (WAF) with XSS filtering rules to sanitize reflected payloads. The most effective mitigation is decommissioning ATutor entirely given lack of vendor support.