PT-2025-38240 · Portabilis · I-Educar

Marceloqz · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10605

Mitre

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda preferencias.php. The manipulation of the argument tipoacao results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be exploited.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10605

Affected Products

I-Educar

References · 6

• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60agenda_preferencias.php%60%20parameter%20%60tipoacao%60.md · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10605.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10605 · Security Note
• https://vuldb.com/?submit.649872 · Note
• https://vuldb.com/?id.324625 · Note
• https://vuldb.com/?ctiid.324625 · Note