| Package | Affected versions | Patched versions |
|---|---|---|
| atutor | ≥ 2.2.1, ≤ 2.2.4 |
ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free