$ cve CVE-2017-1000004 JSON

CVE-2017-1000004

9.8

CRITICAL · CVSS 3.0 · EPSS 4.7% (pctl 92)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	4.73% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	none known
Published	2017-07-17
Last modified	2026-06-17

Affected (1)

Vendor	Product
atutor	atutor

References

→ the Explorer · watch your stack · NVD