Karina Gante

**Name of the Vulnerable Software and Affected Versions** Intelliants Subrion CMS versions prior to 4.0.4 **Description** Cross site scripting is possible via the Blocks Endpoint. Remote attackers can exploit this by manipulating the CSS class name argument. Cross site scripting is a type of security flaw that allows attackers to inject malicious scripts into web pages viewed by other users. **Recommendations** Update to a version newer than 4.0.3. As a temporary workaround, restrict access to the Blocks Endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FluentCMS version 0.0.5 **Description** A cross-site scripting issue exists in the Blocks Plugin component within the '/admin/blocks' file. This flaw allows a remote attacker to initiate an attack through an unknown function in that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mangati NovoSGA versions through 2.2.9 **Description** A security flaw exists in Mangati NovoSGA. The issue is related to cross site scripting within the SVG File Handler component, specifically affecting the file `/admin`. Manipulation of the `logoNavbar/logoLogin` argument can lead to exploitation. Remote exploitation is possible, and the exploit has been publicly released. The vendor was notified but did not respond. **Recommendations** Versions prior to 2.3 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A flaw exists in Portabilis i-Educar that allows for SQL injection through manipulation of an argument in the file `/module/Cadastro/aluno`. This allows for remote exploitation. The exploit for this issue has been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A flaw exists in Portabilis i-Educar up to version 2.10. Manipulation of the `ID` argument in the file '/module/ComponenteCurricular/edit' can lead to SQL injection. This issue is remotely exploitable. The exploit has been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A flaw exists in Portabilis i-Educar that allows for remote code execution. The issue stems from a SQL injection vulnerability within the `/module/ComponenteCurricular/view` file. Manipulation of the `ID` parameter can lead to unauthorized access and potential compromise. The exploit for this issue has been publicly released. **Recommendations** Update to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue is related to cross site scripting in the file `/intranet/educar calendario anotacao cad.php`. Manipulation of the `nm anotacao`/`descricao` argument can lead to exploitation. The attack can be launched remotely. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the file `/intranet/educar calendario anotacao cad.php` to minimize the risk of exploitation. Avoid using the `nm anotacao` and `descricao` parameters in the affected file until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A weakness exists in Portabilis i-Educar up to version 2.10. The issue involves manipulation of the `nm tipo/descricao` argument in an unknown function of the `/intranet/educar modulo cad.php` file, leading to cross site scripting. This attack can be initiated remotely. The exploit has been made publicly available. Recommendations: Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `/intranet/educar modulo cad.php` file to minimize the risk of exploitation. Avoid using the `nm tipo/descricao` argument in the affected file until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A security issue has been identified in Portabilis i-Educar. Manipulation of the `nm tipo` argument in an unknown function within the `/intranet/educar turma tipo cad.php` file can lead to cross-site scripting. This attack can be launched remotely. The exploit has been publicly disclosed. Recommendations: Versions prior to 2.10 should be updated. As a temporary workaround, restrict or disable access to the `/intranet/educar turma tipo cad.php` file.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue impacts an unknown function within the `/intranet/educar nivel ensino cad.php` file. Manipulation of the `nm nivel`/`descricao` argument can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict or sanitize input to the `nm nivel` and `descricao` arguments in the `/intranet/educar nivel ensino cad.php` file.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar that allows for cross site scripting. The issue is related to the manipulation of the `nm tipo` argument within the file `/intranet/educar tipo regime cad.php`. The attack can be initiated remotely. The exploit has been made public. **Recommendations** Versions prior to 2.10: Sanitize the `nm tipo` argument in the `/intranet/educar tipo regime cad.php` file to prevent cross site scripting.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A cross-site scripting issue exists in Portabilis i-Educar. The manipulation of the `descricao` argument within the `/intranet/educar tipo ocorrencia disciplinar cad.php` file can lead to exploitation. The vulnerability is located in an unknown function within this file and can be triggered remotely. The exploit has been publicly disclosed. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, consider restricting access to the `/intranet/educar tipo ocorrencia disciplinar cad.php` file. Sanitize the `descricao` input to prevent script injection.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A cross-site scripting issue exists in Portabilis i-Educar. The issue is related to the manipulation of the `Nome` argument within an unknown function of the `/module/TabelaArredondamento/edit` file, part of the Cadastrar tabela de arredondamento Page component. The attack can be performed remotely. The exploit is publicly available. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, consider sanitizing the `Nome` argument to prevent script injection.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A flaw has been found that allows for cross site scripting. The manipulation of the `nome/formulaMedia` argument in an unknown function of the `/module/FormulaMedia/edit` file causes this issue. The attack can be initiated remotely. **Recommendations** Portabilis i-Educar versions prior to 2.11: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A flaw has been found in Portabilis i-Educar that allows for cross site scripting. The issue is located in the file `/intranet/educar tipo ensino cad.php`, where manipulation of the argument `nm tipo` can be exploited. The attack can be executed remotely. **Recommendations** Update Portabilis i-Educar to a version newer than 2.10.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A cross site scripting issue exists in Portabilis i-Educar up to version 2.10. The issue is located in the file `/intranet/educar projeto cad.php` within the Cadastrar projeto Page. Manipulation of the `nome/observacao` argument can lead to exploitation. The attack can be launched remotely. **Recommendations** Update to a version beyond 2.10.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A cross site scripting issue exists in Portabilis i-Educar up to version 2.10. The issue is located in an unknown function within the `/intranet/educar transferencia tipo cad.php` file of the Cadastrar tipo de transferência Page component. Manipulation of the `nm tipo`/`desc tipo` argument can trigger the issue, allowing for remote attacks. The exploit has been publicly disclosed. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, consider restricting access to the `/intranet/educar transferencia tipo cad.php` file.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A SQL injection issue exists in the Agenda Module of Portabilis i-Educar. The issue is located in the `/intranet/agenda.php` file, affecting an unknown function. Manipulation of the `cod agenda` argument can trigger the injection. This can be initiated remotely. The exploit is publicly available. Recommendations: Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `/intranet/agenda.php` file. Avoid using the `cod agenda` argument until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A flaw has been found in Portabilis i-Educar that allows for SQL injection. Manipulation of the `ID` argument in the `/RegraAvaliacao/view` file can lead to exploitation. The attack can be launched remotely. The vendor was contacted but did not respond. Recommendations: Versions prior to 2.11: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar version 2.10 **Description** A cross-site scripting issue exists in Portabilis i-Educar 2.10. The vulnerability is located in an unknown functionality of the file `/usuarios/tipos/novo`. Manipulation of the `name/description` argument allows for the execution of malicious scripts. The attack can be initiated remotely. The exploit has been publicly disclosed, and the vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.