CVE-2025-41070

MediumCVSS 4.8

Published: 01/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

Sanoma Clickedu contains a Reflected Cross-site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL in '/students/carpetes_varies.php'.

Risk Assessment

The vulnerability can be exploited to steal sensitive user data such as session cookies or to perform actions on behalf of the user.

Recommendation

Update Clickedu to a version containing the fix and implement input validation in '/students/carpetes_varies.php'.

Other vulnerabilities in Clickedu

CVE-2026-5010Medium
A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL using the endpoint '/user.php/'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user's behalf.

Original NVD description (English source)

Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL in '/students/carpetes_varies.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS