CVE-2025-71179
Reflected XSS in Creativeitem Academy LMS Blog and Course Bundles
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| creativeitem | academy_lms | 7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-71179 is a reflected Cross-Site Scripting (XSS) vulnerability in Creativeitem Academy LMS version 7.0. It occurs via the search parameter to the /academy/blogs endpoint and the string parameter to the /academy/course_bundles/search/query endpoint. This means that an attacker can inject malicious scripts into these parameters, which are then reflected back in the web application response, potentially executing in the victim's browser.
This vulnerability is distinct from a previous XSS issue (CVE-2023-4119) that affected different parameters and endpoints in an earlier version of the software.
How can this vulnerability impact me? :
Reflected Cross-Site Scripting (XSS) vulnerabilities like CVE-2025-71179 can allow attackers to execute malicious scripts in the browsers of users who visit specially crafted URLs. This can lead to theft of session tokens, login credentials, or manipulation of site content.
Attackers can send malicious links to victims via email or messaging, and when victims click these links, the injected scripts run in their browsers, potentially compromising user accounts and data confidentiality and integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a reflected Cross-Site Scripting (XSS) issue in Creativeitem Academy LMS 7.0, specifically via the search parameter to the /academy/blogs endpoint and the string parameter to the /academy/course_bundles/search/query endpoint.
To detect this vulnerability, you can test these endpoints by sending crafted HTTP GET requests with XSS payloads in the specified parameters and observe if the payload is reflected unescaped in the response.
- Use curl or similar tools to send requests with XSS payloads, for example:
- curl -G 'http://<target>/academy/blogs' --data-urlencode 'search=<script>alert(1)</script>'
- curl -G 'http://<target>/academy/course_bundles/search/query' --data-urlencode 'string="><img src=x onerror=alert(1)>'
If the response contains the injected script without proper encoding or sanitization, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps for reflected XSS vulnerabilities generally include sanitizing and encoding user input on the server side before reflecting it in responses.
Since this CVE description does not mention available patches or vendor fixes, you should:
- Implement input validation and output encoding on the affected parameters (search and string) to prevent script injection.
- Use a Web Application Firewall (WAF) to block malicious payloads targeting these endpoints.
- Educate users to avoid clicking suspicious links that may exploit this vulnerability.
Monitor for updates or patches from the vendor and apply them as soon as they become available.