CVE-2010-0971 | BDVDB-2026-40704 Detail

Description#

Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the (1) Question and (2) Choice fields in tools/polls/add.php, the (3) Type and (4) Title fields in tools/groups/create_manual.php, and the (5) Title field in assignments/add_assignment.php. NOTE: some of these details are obtained from third party information.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://osvdb.org/62905
http://www.securityfocus.com/bid/38656
http://www.exploit-db.com/exploits/11685
http://secunia.com/advisories/38906
http://osvdb.org/62904
https://exchange.xforce.ibmcloud.com/vulnerabilities/56852
http://packetstormsecurity.org/1003-exploits/atutor-xss.txt
http://osvdb.org/62906

Exploit#

http://www.exploit-db.com/exploits/11685

History#

Version 12010-03-16Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.