CVE-2012-6528: Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 2.1 allow remote attackers to inject a...

Security readout for executives and security teams

CVE-2012-6528 is a set of cross-site scripting flaws in ATutor versions before 2.1. An attacker could inject browser-executed script or HTML through crafted path information on several ATutor pages. Business risk is highest where legacy ATutor is internet-facing and used by authenticated staff, learners, or administrators. Exposure is likely limited to organizations still running ATutor before 2.1, especially public learning-management portals. The bundle’s affected CPE data is incomplete, so asset owners must confirm product and version locally. Prioritize remediation if ATutor is still present and internet-facing. The flaw class can enable session theft, user impersonation, or trusted-page abuse, but available evidence does not show KEV-listed exploitation or a CVSS score. Mitigation focus: Inventory all ATutor deployments and confirm exact versions.; Upgrade ATutor to 2.1 or later where applicable.; Check the ATutor changelog and vendor guidance before relying on compensating controls..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.