PT-2025-38140 · Portabilis · Portabilis I-Educar

Marceloqz · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10591

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10

Description A weakness exists in Portabilis i-Educar up to version 2.10. The issue is related to the manipulation of the abreviatura/tipoacao argument in the /intranet/educar funcao cad.php file within the Editar Função Page component, leading to a cross-site scripting condition. The attack can be carried out remotely. The exploit has been made publicly available.

Recommendations Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the /intranet/educar funcao cad.php file. Avoid using the abreviatura/tipoacao argument in the affected file until the issue is resolved.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10591

Affected Products

Portabilis I-Educar

References · 9

• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60educar_funcao_cad.php%60%20parameters%20%60abreviatura%60,%20%60tipoacao%60.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10591 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10591 · Vendor Advisory
• https://vuldb.com/?submit.648837 · Note
• https://t.me/CVEtracker/32742 · Telegram Post
• https://vuldb.com/?ctiid.324608 · Note
• https://t.me/cveNotify/135649 · Telegram Post
• https://vuldb.com/?id.324608 · Note
• https://twitter.com/CVEnew/status/1968349176770768988 · Twitter Post