CVE-2023-5578
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."
Risk Assessment
Possibility of executing malicious scripts in the user's browser, potentially leading to cookie theft and session hijacking.
Recommendation
Upgrade i-Educar to a version where the vulnerable endpoint has been removed, or apply other mitigating measures.
Other vulnerabilities in i-Educar
See all- CVE-2025-9606Medium
A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda_preferencias.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.
- CVE-2025-9531Medium
A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.
- CVE-2025-9236Medium
A vulnerability was found in Portabilis i-Educar up to 2.10 in the file /intranet/educar_tipo_usuario_lst.php. Manipulation of the nm_tipo/descrição arguments leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 2.12 fixes this issue.
- CVE-2025-8539Low
A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 mitigates this issue. It is recommended to upgrade the affected component. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
Original NVD description (English source)
A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."