Executive brief
ATutor is a learning management system (LMS) used by educational institutions to deliver online courses. A reflected cross-site scripting (XSS) vulnerability in the restore functionality allows attackers to execute arbitrary JavaScript code in victims' browsers by tricking them into clicking a specially crafted link, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
Technical details
CVE-2026-64971 is a reflected XSS vulnerability (CWE-79) in ATutor's restore functionality that fails to properly sanitize user-supplied input in URLs. An attacker can craft a malicious URL containing JavaScript payload that, when visited by an authenticated user, executes arbitrary client-side code in the victim's browser context. The vulnerability does not require authentication to craft the attack, though the victim must be logged in to ATutor for the payload to execute with meaningful privileges. The product is no longer actively maintained; version 2.2.4 was confirmed vulnerable, and other versions may be affected. No patch is available.
Affected products
- ATutor ATutor 2.2.4 (confirmed); other versions untested but likely vulnerable
Timeline
- 2026-08-20: disclosed