{"cve":"CVE-2017-1000004","nvd":{"published":"2017-07-17T13:18:16.030","modified":"2026-06-17T00:58:34.240","status":"Modified","description":"ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-89"],"references":["http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55","http://www.atutor.ca/atutor/mantis/view.php?id=5681","http://www.securityfocus.com/bid/99599","http://www.atutor.ca/atutor/mantis/changelog_page.php?version_id=55","http://www.atutor.ca/atutor/mantis/view.php?id=5681"],"products":["atutor:atutor"],"source":"nvd","synced_at":"2026-10-19T20:43:44.556243339+00:00"},"epss":{"cve":"CVE-2017-1000004","score":0.04728,"percentile":0.91846,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}