CVE-2012-5169: Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent befo...

Security readout for executives and security teams

CVE-2012-5169 is a legacy cross-site scripting issue in ATutor AContent before 1.2-2. An attacker could make the application return attacker-controlled script or HTML through specific file preview parameters. Business risk depends on whether an old AContent instance is still reachable, especially by browsers with authenticated users. Exposure is most likely in legacy ATutor AContent deployments older than 1.2-2 with file_manager/preview_top.php reachable. The bundle lists affected vendor and product as n/a, so asset confirmation should rely on local software inventory and application paths. Prioritize remediation where AContent is public-facing, used by authenticated staff or students, or still contains active session workflows. If no AContent exists, close as not applicable with evidence. Lack of KEV and CVSS lowers urgency, but legacy exposed XSS is still actionable. Mitigation focus: Upgrade ATutor AContent to 1.2-2 or later if still deployed.; Review the vendor patch directory and apply applicable 1.2 fixes.; Restrict access to legacy AContent until remediation is complete..

Prepared

Jun 24, 2026, 19:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.