PT-2025-38245 · Portabilis · I-Educar

Marceloqz · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10607

Mitre

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2025-10607

Affected Products

I-Educar

References · 6

• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10607.md · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Avaliacao.diarioApi.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10607 · Security Note
• https://vuldb.com/?ctiid.324627 · Note
• https://vuldb.com/?id.324627 · Note
• https://vuldb.com/?submit.649875 · Note