Portabilis i-Educar vulnerabilities

A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Manipulation of the ref_cod_aluno argument in educar_historico_escolar_lst.php leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 2.12 resolves the issue.

A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue.