ATutor version 2.2.4 is vulnerable to a reflected Cross-Site Scripting (XSS) vulnerability in the /install/install.php endpoint. This flaw allows an attacker to craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the victim's browser. The product is no longer actively supported, and only version 2.2.4 has been confirmed vulnerable; other versions may also be affected but were not tested.