PT-2025-31896 · Unknown · Portabilis I-Educar

Karina Gante + 1 · Published 2025-08-05 · Updated 2025-08-07 · CVE-2025-8540

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar version 2.10

Description A problematic issue exists in Portabilis i-Educar 2.10 related to cross site scripting. The issue is located in the file /intranet/public municipio cad.php, where manipulation of the nome argument can trigger the vulnerability. The attack can be initiated remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations As a mitigation, consider restricting or carefully validating user input for the nome argument in the /intranet/public municipio cad.php file.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-8540

Affected Products

Portabilis I-Educar

References · 12

• 🔥 https://vuldb.com/?submit.620456 · Exploit
• 🔥 https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/CVE-2025-8540.md · Exploit
• 🔥 https://karinagante.github.io/cve-2025-8540 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8540 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8540 · Vendor Advisory
• https://t.me/CVEtracker/29165 · Telegram Post
• https://t.me/cveNotify/130868 · Telegram Post
• https://vuldb.com/?ctiid.318669 · Note
• https://twitter.com/CVEnew/status/1952571094272975341 · Twitter Post
• https://vuldb.com/?id.318669 · Note
• https://t.me/cveNotify/131207 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1952653569326281167 · Twitter Post