CVE-2025-10846

A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. It affects unknown functionality in the file app/Http/Controllers/AccessLevelController.php of the User Type Handler component. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in SQL injection. The attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A security flaw has been discovered in Portabilis i-Educar up to 2.10, affecting /agenda_preferencias.php. Manipulation of the tipoacao argument results in cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been publicly released.

A cross-site scripting vulnerability was identified in Portabilis i-Educar up to version 2.10, affecting the file /intranet/educar_funcao_cad.php (Editar Função Page component). Manipulation of the abreviatura/tipoacao arguments allows remote exploitation. The exploit has been publicly disclosed and could be used.

A Cross-Site Scripting (XSS) vulnerability was discovered in Portabilis i-Educar up to version 2.10 in the file /intranet/educar_usuario_det.php. By manipulating the ref_pessoa argument, an attacker can inject malicious script. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.

A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A vulnerability in Portabilis i-Educar up to 2.10 affects an unknown function in /module/Api/turma. Manipulation leads to improper authorization. Remote attack possible, exploit publicly disclosed.

Portabilis i-Educar up to 2.10 has an improper access control vulnerability in /exportacao-para-o-seb. Manipulation results in unauthorized access.