Description
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
Remediation
References
Related Vulnerabilities
Internet Information Services Other Vulnerability (CVE-2001-0333)
WordPress Plugin User Profile Picture Information Disclosure (2.4.0)
Liferay DXP Incorrect Authorization Vulnerability (CVE-2025-62275)
WordPress Plugin Helios Solutions Brand Logo Slider Arbitrary File Upload (2.1)
WordPress Plugin YARPP-Yet Another Related Posts PHP Object Injection (4.4)