EUVD-2026-63372
GHSA-327c-7vgx-8jwp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires low-privilege auth (PR:L), mandatory victim click (UI:R), scope change to victim browser (S:C), with low confidentiality/integrity impact; no availability impact.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Reflected XSS in ATutor 2.2.4's restore functionality allows an authenticated low-privileged attacker to craft a malicious URL that executes arbitrary JavaScript in a victim's browser upon interaction. The CVSS 4.0 vector (PR:L/UI:A/SC:L/SI:L) confirms the attack requires a logged-in account, active victim click, and produces subsequent-system impact on the victim's browser session - not the attacker's own context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a low-privileged authenticated account on the target ATutor instance (PR:L) - anonymous/unauthenticated exploitation is not possible per the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 (Medium) accurately reflects a constrained attack: authentication at a low-privilege level (PR:L) and active user interaction (UI:A) are both required, meaningfully reducing the exploitable population compared to unauthenticated, no-interaction flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch exists and none will be issued - ATutor is end-of-life and no longer actively maintained. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today