CVE-2025-10012
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Manipulation of the ref_cod_aluno argument in educar_historico_escolar_lst.php leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 2.12 resolves the issue.
Risk Assessment
Remote SQL injection may allow unauthorized database access, modification, or data leakage. A publicly available exploit increases the risk of rapid exploitation.
Recommendation
Upgrade Portabilis i-Educar to version 2.12 or later. Until then, restrict access to educar_historico_escolar_lst.php and monitor for suspicious queries.
Other vulnerabilities in Portabilis i-Educar
See all- CVE-2026-2015Medium
A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.
- CVE-2025-8538Low
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue.
Original NVD description (English source)
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".