CVE-2016-2555: Atutor

Critical severity, CVSS 9.8. EPSS: 79.6% chance of exploitation in the next 30 days.

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

Affected products

• Atutor Atutor: version 2.2.1 only

Published 2017-04-13. Last modified 2026-06-17.