Atutor

Vendor:

First CVE: Jun 16, 2005 · Active for 21 years

Total CVEs

More Total CVEs than 92% of tracked products

4.7

Avg CVEs / Year

Higher CVE frequency than 88% of tracked products

5.8

Avg CVSS

Higher Avg CVSS than 21% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Atutor over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jun 16, 2005

21 years ago

Most Recent CVE

Jan 19, 2007

7,130 days ago

CVE Severity & Scoring

Atutor14 CVEs

50%

43%

All CVEs353,240 CVEs

45%

40%

11%

LowMediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown14 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown14 (100.0%)

User Interaction

None0 (0.0%)

Unknown14 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown14 (100.0%)

Top CVEs

Signals from CVEs in this product scope (14 CVEs).

14 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2005-3404HIGH Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%	Nov 1, 2005	7.5	32	NO	YES
CVE-2005-4155HIGH registration.PHP in ATutor 1.5.1 pl2 allows remote attackers to execute arbitrary SQL commands via an e-mail address that ends in a NULL character, which bypasses the PHP regular e	Dec 11, 2005	7.5	29	NO	YES
CVE-2006-3662HIGH SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the	Jul 18, 2006	7.5	28	NO	YES
CVE-2005-2954HIGH SQL injection vulnerability in password_reminder.php in ATutor before 1.5.1 pl1 allows remote attackers to execute arbitrary SQL commands via the email field.	Sep 16, 2005	7.5	28	NO	YES
CVE-2006-3996MEDIUM SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the (1) desc or (2) asc paramet	Aug 5, 2006	6.5	26	NO	YES
CVE-2005-2956MEDIUM ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote	Sep 16, 2005	5.0	23	NO	YES
CVE-2005-2649MEDIUM Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via (1) course parameter in login.php or (2) words parameter	Aug 23, 2005	4.3	22	NO	YES
CVE-2005-2044MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.3 and 1.5 RC 1 allow remote attackers to inject arbitrary web script or HTML via the (1) show_course parameter to	Jun 16, 2005	4.3	22	NO	YES
CVE-2007-0381HIGH Multiple SQL injection vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters. NOTE: CVE analysis suggests that the	Jan 19, 2007	7.5	19	NO	NO
CVE-2006-5734HIGH Multiple PHP remote file inclusion vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) section parameter in (a) documentatio	Nov 6, 2006	7.5	19	NO	NO

View all 14 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (14 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

9 CVEs

64.3% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (14 CVEs).

Media Mentions

Signals from CVEs in this product scope (14 CVEs).

Top CNAs Publishing CVEs For Atutor

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
1.5_rc_1	2	4.3	2.1%	1
1.5.3_rc2	1	2.6	2.6%	1
1.5.3.2	2	7.5	1.2%	0
1.5.3	2	5.9	1.3%	1
1.5.1_pl2	3	4.8	2.2%	2
1.5.1_pl1	4	4.7	4.0%	2
1.5.1	8	5.0	3.1%	5
1.4.3	4	5.1	4.1%	2
1.4.2	3	5.4	4.5%	1
1.4.1	3	5.4	4.5%	1