PT-2025-33063 · Portabilis · I-Diario

Feemarb + 2 · Published 2025-08-13 · Updated 2025-08-15 · CVE-2025-8920

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario version 1.6

Description: A vulnerability exists in Portabilis i-Diario 1.6 within the Dicionário de Termos BNCC Page component. Manipulation of the Planos de ensino argument in the /dicionario-de-termos-bncc file leads to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /dicionario-de-termos-bncc file. Sanitize the Planos de ensino argument to prevent script injection.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-8920

Affected Products

I-Diario

References · 10

• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/i-diario/CVE-2025-8920.md · Exploit
• 🔥 https://github.com/FeMarb/CVEs/blob/6eeefb2749bb6165557ed4664a0680456131e4de/I-diario/Cross-Site%20Scripting%20(XSS)%20Storage%20in%20endpoint%20_dicionario-de-termos-bncc%20parameter%20Planos%20de%20ensino%20input%20field.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8920 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8920 · Vendor Advisory
• https://vuldb.com/?ctiid.319879 · Note
• https://vuldb.com/?id.319879 · Note
• https://vuldb.com/?submit.629168 · Note
• https://t.me/cveNotify/132546 · Telegram Post
• https://t.me/CVEtracker/29917 · Telegram Post
• https://twitter.com/CVEnew/status/1955900324511932757 · Twitter Post