SQL Injection in Disenno De Recursos Educativos S.l Virtual Campus Platform
CVE-2025-41009
SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.
Vulnerability class: SQL Injection
EPSS: 0.003 (20.8th percentile) — read the EPSS interpretation.
Affected products
- Disenno De Recursos Educativos S.l Virtual Campus Platform — versions all versions