The ATutor learning management system is vulnerable to reflected Cross‑Site Scripting in the /install/upgrade.php endpoint. An attacker can supply a specially crafted URL that, when a user visits it, causes the browser to execute arbitrary JavaScript. This flaw permits attackers to hijack user sessions, deface content, or perform other malicious actions within the browser context. The weakness is classified as CWE‑79.

ATutor, the open‑source modular learning management system, is affected. Version 2.2.4 has been confirmed to contain the vulnerability. Other releases of ATutor may also be impacted, although they have not been formally tested.

The CVSS score of 5.1 indicates a moderate severity vulnerability that affects confidentiality, integrity and availability of user sessions. With an EPSS score of less than 1 % the likelihood of exploitation in the wild is low, and the flaw is not listed in CISA’s KEV catalogue. The likely attack vector is a user clicking on a malicious link that contains the reflected payload; the attacker must first convince a user to visit the crafted URL and the exploitation requires no special privileges on the server side or other system resources.