Description

Multiple eval injection vulnerabilities in mods/_standard/gradebook/edit_marks.php in ATutor 2.2 and earlier allow remote authenticated users with the AT_PRIV_GRADEBOOK privilege to execute arbitrary PHP code via the (1) asc or (2) desc parameter.

Remediation

References

CVE-2015-7712

Related Vulnerabilities

Jetty Uncontrolled Resource Consumption Vulnerability (CVE-2022-2048)

Oracle HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2022-21716)

WordPress Plugin Customer Reviews for WooCommerce Cross-Site Scripting (5.16.0)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-5876)

WordPress Plugin Nooz Cross-Site Scripting (1.6.0)

Severity

Medium

Classification

CVE-2015-7712

Tags

Missing Update Known Vulnerabilities