CVE-2025-10590
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was discovered in Portabilis i-Educar up to version 2.10 in the file /intranet/educar_usuario_det.php. By manipulating the ref_pessoa argument, an attacker can inject malicious script. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker could execute arbitrary JavaScript in the victim's browser, potentially leading to session data theft or actions performed on behalf of the user. The publicly available exploit increases the risk of exploitation.
Recommendation
Update i-Educar to a version newer than 2.10 that contains the fix. Until then, implement additional input and output filtering.
Other vulnerabilities in Portabilis i-Educar
See all- CVE-2026-2015Medium
A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.
- CVE-2025-11554Medium
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. It affects unknown functionality in the file app/Http/Controllers/AccessLevelController.php of the User Type Handler component. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-10846Medium
A vulnerability in Portabilis i-Educar up to 2.10 affects unknown code in the file /module/ComponenteCurricular/edit. Manipulation of the argument ID causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-10845Medium
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in SQL injection. The attack can be executed remotely. The exploit has been made public and could be used.
- CVE-2025-10608Medium
A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.
- CVE-2025-10605Medium
A security flaw has been discovered in Portabilis i-Educar up to 2.10, affecting /agenda_preferencias.php. Manipulation of the tipoacao argument results in cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been publicly released.
- CVE-2025-10591Low
A cross-site scripting vulnerability was identified in Portabilis i-Educar up to version 2.10, affecting the file /intranet/educar_funcao_cad.php (Editar Função Page component). Manipulation of the abreviatura/tipoacao arguments allows remote exploitation. The exploit has been publicly disclosed and could be used.
- CVE-2025-10584Low
A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- CVE-2025-10073Medium
A vulnerability in Portabilis i-Educar up to 2.10 affects an unknown function in /module/Api/turma. Manipulation leads to improper authorization. Remote attack possible, exploit publicly disclosed.
- CVE-2025-10013Medium
Portabilis i-Educar up to 2.10 has an improper access control vulnerability in /exportacao-para-o-seb. Manipulation results in unauthorized access.
Original NVD description (English source)
A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php. The manipulation of the argument ref_pessoa results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS