ATutor contains a reflected cross-site scripting (XSS) vulnerability in the /install/upgrade.php endpoint. This flaw allows an attacker to craft a malicious URL that executes arbitrary JavaScript code in the victim's browser when visited. The product is no longer actively supported, and only version 2.2.4 has been confirmed vulnerable. Other versions may also be affected but were not tested.