{"id":"CVE-2025-9638","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint…","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"portabilis","product":"i-educar","affected":["i-educar = 2.10.0"],"published":"2025-12-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9638","references":[{"url":"https://fluidattacks.com/advisories/travis","label":"help@fluidattacks.com"},{"url":"https://github.com/portabilis/i-educar","label":"help@fluidattacks.com"},{"url":"https://fluidattacks.com/advisories/travis","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00215,"epssPercentile":0.11124,"ingestedAt":"2026-10-14T21:57:04.751Z","slug":"CVE-2025-9638","body":"## Overview\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint.\nThis issue affects i-Educar: 2.10.0.\n\n## Affected\n\n- `i-educar = 2.10.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}