ATutor XSS flaws in unsupported software
Two reflected XSS vulnerabilities in ATutor's installation endpoints allow arbitrary JavaScript execution via crafted URLs, but the product is no longer supported.
CERT Polska has disclosed two reflected cross-site scripting (XSS) vulnerabilities in ATutor, an e-learning platform that is no longer actively maintained. CVE-2026-6909 affects the /install/upgrade.php endpoint, while CVE-2026-6956 affects /install/install.php. Both flaws allow attackers to execute arbitrary JavaScript in victims' browsers through specially crafted URLs.
Version 2.2.4 was confirmed vulnerable during testing, though other versions may also be affected. The maintainers were notified but did not respond with details about the scope or affected versions. Because ATutor is no longer supported, no patches are expected.
The vulnerabilities were responsibly disclosed by researchers from AFINE through CERT Polska's coordinated vulnerability disclosure process. Organizations still running ATutor should consider migrating to actively maintained alternatives, as these XSS flaws will remain unpatched.
Mentioned in this report
Detection guidance
Reflected XSS Attempt Against ATutor install/upgrade Endpoints
Detects HTTP requests containing script injection payloads in query strings targeting ATutor's install/upgrade.php or install/install.php endpoints, indicative of exploitation attempts for CVE-2026-6909/CVE-2026-6956. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against ATutor Install Endpoints
id: ea854e74-12e2-56cd-8bc0-2511f9d9532a
status: experimental
description: 'Detects HTTP requests to ATutor''s /install/upgrade.php or /install/install.php
endpoints where the query string contains common XSS payload markers such as
<script>, onerror=, javascript:, or SVG/onload constructs. These endpoints are
affected by reflected XSS vulnerabilities (CVE-2026-6909, CVE-2026-6956) in
the unsupported ATutor e-learning platform, allowing arbitrary JavaScript
execution in a victim''s browser via a crafted URL.
'
references:
- https://cert.pl
author: Vorant
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- /install/upgrade.php
- /install/install.php
selection_payload:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
- '%3Cscript'
- alert(
- confirm(
- svg/onload
condition: selection_path and selection_payload
falsepositives:
- Automated vulnerability scanners or security testing tools probing the ATutor installation
for known XSS issues
- Legitimate developers or QA testers manually verifying the reported vulnerability
level: medium
tags:
- attack.T1190
- attack.initial_access
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6909
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free