CVE-2024-48326

CVE-2024-48326 説明: Portabilis i-Educar v2.8.0 には、/intranet/educarreligiaocad.php への POST リクエストの nmreligiao パラメータを介した Cross-Site Scripting XSS の脆弱性があり、/intranet/educarreligiaolst.php?busca=S&nmreligiao= への GET リクエストでトリガーされます。これにより、認証されていないリモート攻撃者が悪意のある JavaScript...

portabilis-ieducar-user-type-privilege-escalation

Portabilis i-Educar = 2.1.13 通过任意请求用户类型变更端点实现权限提升 针对 CVE-2025-11554 中所述漏洞的利用概念验证，该漏洞涉及 i-Educar 软件中通过任意请求用户类型端点实现权限提升的可能性。 描述 没有更改用户类型所需权限的用户，可以通过向负责此操作的端点发送任意请求来修改已注册用户类型的权限。这允许低权限用户通过向其关联的用户类型授予最大权限来提升自身权限，从而危及应用程序的所有部分。 概念验证 为演示该漏洞，我们将模拟一条可在真实利用场景中使用的攻击路径。首先，我们有一个用户 Usuário sem Privilégios...

cve-2024-48325

CVE-2024-48325 描述： 已认证用户可利用 InstituicaoDocumentacaoController 类的 getDocuments 函数中存在的 SQL 注入漏洞。/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicaoid 中的 instituicaoid 参数未正确过滤，允许已认证的远程攻击者注入恶意 SQL 命令。 版本： 发现于 Portabilis i-Educar 2.8.0。 概念验证 漏洞详情 该问题存在于...

CVE-2026-4355

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

EUVD-2026-12686

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application developed by Portábilis Corporation. It can conveniently assist you in basic and technical education. Version 2.11 of Portábilis i-Educar contains a code injection vulnerability. This vulnerability arises from improper handling of the Name parameter in the...

CVE-2026-4355 Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

CVE-2026-4355

Portabilis i-Educar 2.11 contains a cross-site scripting vulnerability in the Endpoint component, specifically in the file /intranet/educar_servidor_curso_lst.php where manipulating the Name argument triggers XSS. The attack can be remote, and public exploits exist. Vendor did not respond to disc...

CVE-2026-4355

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educarservidorcursolst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit ...

PT-2026-25965

A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar servidor curso lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The explo...

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2064

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

EUVD-2026-5595

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064 Portabilis i-Educar User Data meusdadod.php cross site scripting

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064 Portabilis i-Educar User Data meusdadod.php cross site scripting

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the atta...

CVE-2026-2064

CVE-2026-2064 affects Portabilis i-Educar up to version 2.10. The vulnerability is in the file /intranet/meusdadod.php of the User Data Page, where manipulation of the File argument leads to cross-site scripting. It can be exploited remotely and a public exploit exists. Multiple sources confirm t...

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2015 Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...

CVE-2026-2015 Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument schoolid can lead to improper authorization. The attack can be executed remotel...