ATutor is vulnerable to a reflected cross‑site scripting flaw through the popup parameter in preview.php. An attacker authenticated to the system can insert a double‑quote character that breaks out of the attribute context and appends a new event handler such as onload. The preview_top.php file performs sanitisation, but this does not protect the parent frameset rendered by preview.php, allowing the injected code to execute in the user’s browser. Version 2.2.4 has been confirmed vulnerable and other releases have not been tested, so they may also be affected.

The affected product is ATutor, specifically version 2.2.4 and potentially earlier or later releases of the same product. ATutor is no longer actively supported and no fixes have been released for this issue.

The vulnerability has a CVSS score of 4.8, which is moderate, and there is no EPSS score available. It is not listed as a known exploited vulnerability by CISA. An attacker must be authenticated to the application, but the vulnerability enables script execution in the victim’s browser, leading to potential data theft or session hijacking. Because the software is out of support, the risk is primarily mitigated by removing the exposed functionality or relocating to a supported platform.