PT-2025-39147

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10 Description A flaw exists in Portabilis i-Educar that allows for SQL injection through manipulation of an argument in the file /module/Cadastro/aluno. This allows for remote exploitation. The exploit for...

i-Educar SQL注入漏洞

i-Educar is a free educational software from Portábilis Open Source. A SQL injection vulnerability exists in i-Educar version 2.10 and earlier, which stems from incorrect manipulation of the parameter IDs in the file /module/ComponenteCurricular/view, which could lead to a SQL injection attack...

CVE-2025-10608

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-10607

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-10606

A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2025-10605

A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agendapreferencias.php. The manipulation of the argument tipoacao results in cross site scripting. The attack may be launched remotely. The exploit has been released to the...

CVE-2025-10590

A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educarusuariodet.php. The manipulation of the argument refpessoa results in cross site scripting. The attack can be executed remotely. The exploit has been...

CVE-2025-10591

A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educarfuncaocad.php of the component Editar Função Page. This manipulation of the argument abreviatura/tipoacao causes cross site scripting. The attack is possible to be carrie...

CVE-2025-10584

A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educarcalendarioanotacaocad.php. Such manipulation of the argument nmanotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit ...

CVE-2025-10608

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-10608 Portabilis i-Educar enrollment-history access control

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-10608 Portabilis i-Educar enrollment-history access control

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-10608 Portabilis i-Educar enrollment-history access control

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used...

CVE-2025-10606

A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2025-10607

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-10605

A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agendapreferencias.php. The manipulation of the argument tipoacao results in cross site scripting. The attack may be launched remotely. The exploit has been released to the...

CVE-2025-10607 Portabilis i-Educar diarioApi information disclosure

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-10607

CVE-2025-10607 affects Portabilis i-Educar up to version 2.10, with an issue in an unknown function in /module/Avaliacao/diarioApi that can lead to information disclosure. Exploitation is possible remotely and has been publicly disclosed. Several connected sources (Red Hat, CVE records, OSV, CNNV...

CVE-2025-10607 Portabilis i-Educar diarioApi information disclosure

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-10606 Portabilis i-Educar ConfiguracaoMovimentoGeral cross site scripting

A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. Remote exploitation of the attack is possible. The...