Atutor

Atutor

29 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2016-2539

Exploit
  • EPSS 0.08%
  • Veröffentlicht 07.02.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving ...

6.5

CVE-2015-7712

Exploit
  • EPSS 0.6%
  • Veröffentlicht 16.11.2015 19:59:02
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the (1) asc or (2) desc parameter.

6.5

CVE-2014-9752

  • EPSS 0.7%
  • Veröffentlicht 16.11.2015 19:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension as a customicon for a new course,...

3.5

CVE-2014-2091

Exploit
  • EPSS 0.52%
  • Veröffentlicht 02.03.2014 17:55:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action. NOTE: the origina...

4.3

CVE-2012-6528

Exploit
  • EPSS 6.31%
  • Veröffentlicht 31.01.2013 05:44:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) themes/default/tile_search/index.tmpl.php, (2) login.php, (3) search.php, (4) password_rem...

5

CVE-2011-3706

Exploit
  • EPSS 0.28%
  • Veröffentlicht 23.09.2011 23:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.

2.1

CVE-2010-0971

Exploit
  • EPSS 1.23%
  • Veröffentlicht 16.03.2010 19:00:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type a...

6.5

CVE-2008-3368

  • EPSS 4.71%
  • Veröffentlicht 30.07.2008 17:41:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via a URL in the type parameter.

4.3

CVE-2008-0828

  • EPSS 0.29%
  • Veröffentlicht 19.02.2008 21:44:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) attributes such as style and onmouseover in (a) forum post or (b) mail; or (2) the website field of ...