CVE-2025-41009: Disenno De Recursos Educativos S.l Virtual Campus Platform

Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.

Affected products

• Disenno De Recursos Educativos S.l Virtual Campus Platform: any version

Published 2025-10-27. Last modified 2026-10-08.