What is GHSA-327c-7vgx-8jwp?

GHSA-327c-7vgx-8jwp is a security advisory published by GitHub Security Advisories with Medium severity. ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a...

Which CVE IDs does GHSA-327c-7vgx-8jwp cover?

GHSA-327c-7vgx-8jwp covers the following CVE IDs: CVE-2026-64971. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-327c-7vgx-8jwpMedium

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a...

Vendor

GitHub Security Advisories

Published

August 20, 2026

Last Modified

August 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-64971 →

📋 Description

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-64971
https://atutor.github.io
https://cert.pl/en/posts/2026/08/CVE-2026-64960
https://github.com/advisories/GHSA-327c-7vgx-8jwp