CVE-2026-2015
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.
Risk Assessment
An attacker could gain access to data or functions they are not authorized for, potentially leading to data confidentiality breaches.
Recommendation
Upgrade to version 2.11.0 or later, which contains the fix.
Other vulnerabilities in Portabilis i-Educar
See all- CVE-2025-10012Medium
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Manipulation of the ref_cod_aluno argument in educar_historico_escolar_lst.php leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 2.12 resolves the issue.
- CVE-2025-8538Low
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue.
Original NVD description (English source)
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.11.0 is able to address this issue. Upgrading the affected component is advised. The vendor explains, that "[t]he reported attack vector was tested against the corrected code, and the previously described behavior could no longer be reproduced".