CVE-2025-10099Low· 2.4▾ TwilightPoC availableA weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuario_cad.php of the component Editar usuário Page. This manipulation of the argu…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 13.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuario_cad.php of the component Editar usuário Page. This manipulation of the argument email/data_inicial/data_expiracao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 addresses this issue. Patch name: 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. You should upgrade the affected component.
i-Educar 2.0i-Educar 2.1i-Educar 2.2i-Educar 2.3i-Educar 2.4i-Educar 2.5i-Educar 2.6i-Educar 2.7i-Educar 2.8i-Educar 2.9i-Educar 2.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10074Low· 3.5Portabilis i-Educar tipos cross site scripting
CVE-2025-8538Low· 2.4A security flaw has been discovered in Portabilis i-Educar 2.10
CVE-2025-8539Low· 2.4A weakness has been identified in Portabilis i-Educar 2.10
CVE-2025-10070Medium· 6.3Portabilis i-Educar enturmacao-em-lote access control
CVE-2025-10071Medium· 6.3Portabilis i-Educar cancelar-enturmacao-em-lote access control
CVE-2025-11554Medium· 6.3A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10