PT-2025-32463 · Unknown · Portabilis I-Educar

Natan Morette + 1 · CVE-2025-8790 · Published 2025-08-10 · Updated 2025-08-13

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.9.0

Description: A critical issue exists in Portabilis i-Educar related to improper authorization. The vulnerability is located in the API Endpoint component, specifically within the /module/Api/pessoa file. Manipulation of the ID argument can lead to unauthorized access. The exploit is publicly available and can be initiated remotely. The vendor was informed of this issue but did not provide a response.

Recommendations: Versions prior to 2.9.0: Address improper authorization by validating the ID argument in the /module/Api/pessoa API Endpoint.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-8790

Affected Products

Portabilis I-Educar

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8790.json · Exploit
• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8790.md · Exploit
• 🔥 https://vuldb.com/?submit.625918 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8790 · Security Note
• https://twitter.com/f8sbrightermind/status/1954408435241333148 · Twitter Post
• https://vuldb.com/?id.319318 · Note
• https://t.me/CVEtracker/29605 · Telegram Post
• https://t.me/cveNotify/132076 · Telegram Post
• https://t.me/cveNotify/131580 · Telegram Post
• https://vuldb.com/?ctiid.319318 · Note