Medium severity · published Dec 1, 2025
CVE-2025-41070
Reflected Cross-site Scripting (XSS) in Sanoma's Clickedu
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL in '/students/carpetes_varies.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clickedu · Sanoma
All versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41070
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu
More from Clickedu
5.1
CVE-2026-5010
Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu