Reflected XSS Vulnerability in ATutor by A Tutor Group
CVE-2026-64972

4.8MEDIUM

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64972?

The ATutor platform contains a vulnerability that allows authenticated attackers to execute Reflected XSS attacks through manipulation of the 'popup' parameter in the 'preview.php' file. By injecting a double quote into this parameter, attackers can escape the attribute value and introduce harmful event handlers, like 'onload', into the response. Although the 'preview_top.php' file attempts to sanitize certain parameters, this fails to prevent XSS issues within the parent frameset rendered by 'preview.php'. Notably, ATutor 2.2.4 has been confirmed vulnerable, and the product is no longer actively supported, leaving potential exploits unaddressed in untested versions.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.