CVE-2026-64972
Received Received - Intake

Reflected Cross-Site Scripting in ATutor preview.php

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related preview_top.php file sanitises these parameters, but that does not prevent XSS in the parent frameset rendered by preview.php itself. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64972
EUVD
EUVD-2026-63373

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
atutor atutor to 2.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ATutor has a reflected Cross-Site Scripting (XSS) vulnerability in the popup parameter of preview.php. An authenticated attacker can inject a double quote to break out of the attribute value and add an event handler like onload. The preview_top.php file attempts to sanitize inputs but does not prevent XSS in the parent frameset rendered by preview.php.

Detection Guidance

To detect this vulnerability, inspect web server logs for requests to preview.php with a popup parameter containing suspicious input like double quotes or event handlers (e.g., onload). Manually test by sending crafted URLs to preview.php and checking for reflected XSS in the response.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on their behalf. Since ATutor is no longer supported, there are no patches available.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Compliance failures could result in legal penalties or data breach notifications.

Mitigation Strategies

Since ATutor is no longer supported and unpatched, the only reliable mitigation is to disable or remove the vulnerable preview.php file. Additionally, restrict access to authenticated users only and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart