CVE-2014-2091: Atutor

Low severity, CVSS 3.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an add_forum action. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.

Affected products

• Atutor Atutor: version 2.1.1 only

Published 2014-03-02. Last modified 2026-06-17.