ATutor version 1.6.4 suffers from a cross site scripting vulnerability.