What is the CVSS score of CVE-2025-71179?

CVE-2025-71179 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Academy Lms are affected by CVE-2025-71179?

Organizations using Creativeitem Academy LMS 7.0 should be aware of moderate risk from CVE-2025-71179, a cross-site scripting vulnerability rated CVSS 6.1.

Is there a public PoC exploit available for CVE-2025-71179?

Yes, a public proof-of-concept exploit is available for CVE-2025-71179. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-71179?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Academy Lms CVE-2025-71179

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-03 cve@mitre.org

XSS Academy Lms Creativeitem

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 10, 2026 - 14:02 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 18:16 nvd

MEDIUM 6.1

DescriptionCVE.org

Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the search component of Academy Lms. Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.