CVE-2025-71179: XSS
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/coursebundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sortby parameters to the /academy/home/courses endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71179?
CVE-2025-71179 is considered to have a medium severity due to its reflected Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2025-71179?
To fix CVE-2025-71179, ensure you validate and sanitize user input on the affected endpoints to prevent XSS.
What are the affected endpoints in CVE-2025-71179?
The affected endpoints in CVE-2025-71179 are /academy/blogs and /academy/course_bundles/search/query.
What versions of Creativeitem Academy LMS are impacted by CVE-2025-71179?
Creativeitem Academy LMS version 7.0 is impacted by CVE-2025-71179.
Is CVE-2025-71179 related to any other vulnerabilities?
CVE-2025-71179 is distinct from CVE-2023-4119, which addressed different issues.