PT-2025-32457 · Unknown · Portabilis I-Educar

Marceloqz · Published 2025-08-09 · Updated 2025-08-12 · CVE-2025-8784

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.9

Description: A problematic issue exists in Portabilis i-Educar up to version 2.9, specifically within the Cadastrar Vínculo Page. The issue involves the manipulation of the nome argument in the /intranet/funcionario vinculo cad.php file, leading to cross site scripting. This attack can be initiated remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: Versions prior to 2.9 should be updated. As a temporary workaround, consider restricting access to the /intranet/funcionario vinculo cad.php file. Sanitize the nome parameter to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-8784

Affected Products

Portabilis I-Educar

References · 11

• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20funcionario_vinculo_cad.php%20parameter%20nome.md · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8784.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-8784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8784 · Security Note
• https://vuldb.com/?id.319312 · Note
• https://t.me/cveNotify/131849 · Telegram Post
• https://t.me/CVEtracker/29599 · Telegram Post
• https://twitter.com/CVEnew/status/1954325200410988715 · Twitter Post
• https://vuldb.com/?ctiid.319312 · Note
• https://vuldb.com/?submit.625777 · Note
• https://t.me/cveNotify/131568 · Telegram Post