PT-2025-48436 · Sangoma · Sanoma Clickedu

Published 2025-12-01 · Updated 2025-12-01 · CVE-2025-41070

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sanoma Clickedu (affected versions not specified)

Description A Reflected Cross-site Scripting (XSS) issue exists in Sanoma's Clickedu. This allows an attacker to execute JavaScript code in a victim's browser by sending a malicious URL. The vulnerable endpoint is '/students/carpetes varies.php'. Successful exploitation could lead to the theft of sensitive user data, such as session cookies, or the performance of actions on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41070

Affected Products

Sanoma Clickedu

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41070 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu · Note
• https://twitter.com/CVEnew/status/1995451756625703106 · Twitter Post
• https://t.me/CVEtracker/38531 · Telegram Post
• https://twitter.com/incibe_cert/status/1995425934824845531 · Twitter Post