---
id: CVE-2025-8539
title: A weakness has been identified in Portabilis i-Educar 2.10
summary: >-
  A weakness has been identified in Portabilis i-Educar 2.10. This affects an
  unknown function of the file /intranet/public_distrito_cad.php. This
  manipulation of the argument nome causes cross site scripting. The attack is
  possible to be …
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
  - CWE-94
vendor: portabilis
product: i-educar
affected:
  - i-educar = 2.10.0
published: '2025-08-05'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T03:17:05.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8539'
references:
  - url: 'https://github.com/portabilis/i-educar/tree/2.12'
    label: cna@vuldb.com
  - url: 'https://karinagante.github.io/cve-2025-8539/'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2025-8539'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/620453'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/318668'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/318668/cti'
    label: cna@vuldb.com
  - url: >-
      https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/CVE-2025-8539.md
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://vuldb.com/?submit.620453'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-08-05T13:40:40.310056Z'
epss: 0.00295
epssPercentile: 0.19749
ingestedAt: '2026-09-15T03:19:45.415Z'
---

## Overview

A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 mitigates this issue. It is recommended to upgrade the affected component. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".

## Affected

- `i-educar = 2.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.