portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 任意リクエストによるユーザータイプ変更エンドポイントを介した権限昇格 CVE-2025-11554 に記載された脆弱性の悪用に関する概念実証です。これは、i-Educar ソフトウェアにおいて、ユーザータイプのエンドポイントへの任意リクエスト中に権限昇格が発生する可能性に関するものです。 説明...

cve-2024-48325

CVE-2024-48325 説明: 認証されたユーザーは、InstituicaoDocumentacaoController クラスの getDocuments 関数に存在する SQL インジェクションの脆弱性を悪用できます。/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicaoid の instituicaoid パラメータは適切にサニタイズされておらず、認証されたリモート攻撃者が悪意のある SQL コマンドを注入することを可能にします。 バージョン: Portabilis...

CVE-2024-48326

CVE-2024-48326 説明: Portabilis i-Educar v2.8.0 には、/intranet/educarreligiaocad.php への POST リクエストの nmreligiao パラメータを介した Cross-Site Scripting XSS の脆弱性があり、/intranet/educarreligiaolst.php?busca=S&nmreligiao= への GET リクエストでトリガーされます。これにより、認証されていないリモート攻撃者が悪意のある JavaScript...

EUVD-2026-12686

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

CVE-2026-4355: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

CVE-2026-4355 Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

CVE-2026-4355

Portabilis i-Educar 2.11 contains a cross-site scripting vulnerability in the Endpoint component, specifically in the file /intranet/educar_servidor_curso_lst.php where manipulating the Name argument triggers XSS. The attack can be remote, and public exploits exist. Vendor did not respond to disc...

CVE-2026-4355

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

PT-2026-25965

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar servidor curso lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The explo...

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2064

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

EUVD-2026-5595

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064 Portabilis i-Educar User Data meusdadod.php cross site scripting

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064 Portabilis i-Educar User Data meusdadod.php cross site scripting

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064

CVE-2026-2064 affects Portabilis i-Educar up to version 2.10. The vulnerability is in the file /intranet/meusdadod.php of the User Data Page, where manipulation of the File argument leads to cross-site scripting. It can be exploited remotely and a public exploit exists. Multiple sources confirm t...

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2015 Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2015 Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...