CVE-2017-6483

CVE-2017-6483 describes multiple Cross-Site Scripting (XSS) vulnerabilities in ATutor 2.2.2, specifically due to inadequate input validation of the 'lang_code' parameter in language_edit.tmpl.php. An unauthenticated attacker could exploit this to inject and execute arbitrary HTML or script code within a user's browser, leading to potential information disclosure or session hijacking. Rated Medium severity (CVSS 6.1), it requires user interaction (UI:R) but can be exploited remotely (AV:N). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.