CVE-2026-64971
Received Received - Intake

Reflected Cross-Site Scripting in ATutor 2.2.4

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64971
EUVD
EUVD-2026-63372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
atutor atutor to 2.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ATutor has a reflected cross-site scripting (XSS) vulnerability in its restore functionality. This means an attacker can craft a malicious URL that, when accessed by a user, executes arbitrary JavaScript in the user's browser. The vulnerability exists because ATutor does not properly sanitize user input during the restore process.

Detection Guidance

Since ATutor is no longer supported and the vulnerability is in the restore functionality, check for XSS attempts in URLs related to restore operations. Monitor browser console logs for JavaScript errors when accessing ATutor pages. Look for unusual network requests or responses containing script tags in restore-related endpoints.

Impact Analysis

This vulnerability could allow an attacker to steal sensitive user data, such as login credentials or session tokens, by tricking users into clicking a malicious link. It could also be used to perform actions on behalf of the user, modify page content, or redirect users to malicious websites.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially resulting in fines. For HIPAA, it may compromise protected health information, leading to compliance violations and penalties. The lack of fixes increases ongoing risk.

Mitigation Strategies

Immediately disable or restrict access to the ATutor restore functionality. If possible, upgrade to a supported alternative. Implement network-level protections like WAF rules to block XSS payloads. Monitor for any signs of exploitation and isolate affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart