CVE-2026-5010

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.

• CWE-79

• https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-sanomas-clickedu-0

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50088The Aqara Developer Portal (developer.aqara.com) and shared …4.7
• CVE-2026-50089The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an…6.1
• CVE-2026-50090The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.…6.1
• CVE-2026-50091Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and whi…7.4
• CVE-2026-50093A vulnerability has been identified in Siveillance Control P…9
• CVE-2026-50099During WiFi association, Naxclow device firmware prints the …5.1
• CVE-2026-50100Multiple printer drivers provided by Ricoh Company, Ltd. and…8.5
• CVE-2026-50101Naxclow devices use a server-side, per-device relay credenti…9.2
• CVE-2026-50103A NULL pointer dereference in the L2 GOOSE and R-GOOSE share…7.1
• CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only …4.3
• CVE-2026-50107When NGINX Plus or NGINX Open Source is configured as the da…8.6
• CVE-2026-50108The Naxclow platform API that returns device relay registrat…8.7