Atutor vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-64966 ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality.High 8.7 · Aug 20, 2026
• CVE-2026-64960 ATutor Gameme module allows users to upload files of any type and extension without restriction.High 8.7 · Aug 20, 2026
• CVE-2020-37147 ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through tHigh 7 · Feb 6, 2026
• CVE-2021-43498 An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters arHigh 7.5 · Apr 8, 2022
• CVE-2020-10557 An issue was discovered in AContent through 1.4.High 8.8 · Mar 16, 2020
• CVE-2015-1583 Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests thatHigh 8.8 · Mar 2, 2020
• CVE-2014-9753 confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.Critical 9.8 · Feb 11, 2020
• CVE-2019-16114 In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to thCritical 9.8 · Sep 9, 2019
• CVE-2019-12169 ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/lanHigh 8.8 · Jun 3, 2019
• CVE-2019-12170 ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component.High 8.8 · May 17, 2019
• CVE-2019-11446 An issue was discovered in ATutor through 2.2.4.High 8.8 · Apr 22, 2019
• CVE-2016-10400 Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php.High 7.5 · Jul 22, 2017
• CVE-2017-1000004 ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, CourCritical 9.8 · Jul 17, 2017
• CVE-2017-1000003 ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege eCritical 9.8 · Jul 17, 2017
• CVE-2017-1000002 ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution.Critical 9.8 · Jul 17, 2017
• CVE-2016-2555 SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriendsCritical 9.8 · Apr 13, 2017
• CVE-2016-2539 Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for High 8.8 · Feb 7, 2017
• CVE-2012-5168 ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_sHigh 7.5 · Oct 22, 2012
• CVE-2012-5167 Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to cHigh 7.5 · Oct 22, 2012
• CVE-2009-4945 AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via requests to index.php.High 7.5 · Jul 22, 2010