PT-2026-6716 · Unknown · Portabilis I-Educar

Vini_Castro · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-2015

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10

Description A weakness exists in Portabilis i-Educar up to version 2.10, specifically within the Final Status Import component. The issue involves improper authorization that can be triggered by manipulating the school id argument within an unknown function of the FinalStatusImportService.php file. This manipulation can be executed remotely. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 2.10 should be updated. As a temporary workaround, consider restricting access to the FinalStatusImportService.php file to minimize the risk of exploitation.

Exploit

Correção

Improper Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-285

CWE-266

Identificadores relacionados

CVE-2026-2015

Produtos afetados

Portabilis I-Educar

Referências · 11

• 🔥 https://github.com/ViniCastro2001/Security_Reports/tree/main/i-educar/BFLA-Final-Status-Import · Exploit
• 🔥 https://github.com/ViniCastro2001/Security_Reports/tree/main/i-educar/BFLA-Final-Status-Import#proof-of-concept-poc · Exploit
• https://t.me/CVEtracker/43933 · Publicação no Telegram
• https://vuldb.com/?ctiid.344597 · Nota
• https://vuldb.com/?submit.743760 · Nota
• https://osv.dev/vulnerability/CVE-2026-2015 · Aviso do Fabricante
• https://t.me/cveNotify/151117 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2015 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2019815516056015310 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2019728318161883171 · Publicação no Twitter
• https://vuldb.com/?id.344597 · Nota