CVE-2024-48325

CVE-2024-48325 affects Portabilis i-Educar 2.8.0. A SQL injection exists in getDocuments() of InstituicaoDocumentacaoController where the instituicao_id parameter is interpolated into SQL without sanitization, enabling unauthenticated remote exploitation. Multiple connected sources confirm the is...

CVE-2024-55651

CVE-2024-55651 pertains to i-Educar (version 2.9) where the application fails to validate and sanitize input in the user type field, causing a stored cross-site scripting (XSS) vulnerability. The root cause is improper input handling of the Tipo de Usuário field, which could allow an attacker to ...

CVE-2023-5578

CVE-2023-5578 affects Portábilis i-Educar up to 2.7.5. The vulnerability is a cross-site scripting flaw in the HTTP GET Request Handler, specifically in the file intranet\agenda_imprimir.php, where the cod_agenda parameter can be injected with a payload like );'> . Remote exploitation is possi...

CVE-2024-45059

CVE-2024-45059 describes an authenticated SQL Injection in i-Educar prior to version 2.9, where the query in ieducar/intranet/funcionario_vinculo_det.php is built by concatenating the unsanitized GET parameter cod_func. This allows an attacker to access sensitive data such as emails and password ...

CVE-2024-55239

Portabilis i-Educar 2.9 is affected by a reflected XSS in the standard documentation upload functionality, exploitable via the titulo_documento parameter to craft malicious URLs with arbitrary JavaScript. CVE-2024-55239 is rated CVSS v3.1 base 5.4 (Medium). Exploitation details are not described ...

CVE-2024-12893

Portabilis i-Educar up to version 2.9 is affected by a cross-site scripting (XSS) vulnerability in the Tipo de Usuário Page, specifically via manipulation of the name argument to /usuarios/tipos/2. The issue affects an unknown functionality and can be triggered remotely; public exploits have been...

CVE-2024-45057

The CVE-2024-45057 entry describes a Reflected Cross-Site Scripting (XSS) vulnerability in i-Educar prior to v2.9. The issue arises from insufficient validation/sanitization of user-controlled input in the dynamic generation of HTML fields, specifically in the file intranet/include/clsCampos.inc....

CVE-2024-45058

CVE-2024-45058 affects Portabilis Portábilis i-Educar prior to version 2.9. The issue resides in ieducar/intranet/educar_usuario_cad.php where a crafted POST to /intranet/educar_usuario_cad.php can change a user’s type by altering the nivel_usuario_ parameter, because the script does not verify t...

CVE-2025-8790

CVE-2025-8790 affects Portabilis i-Educar up to 2.9.0. The vulnerability is in the API Endpoint component, specifically the file /module/Api/pessoa, where manipulating the ID argument leads to improper authorization. The issue is exploitable remotely, with exploits disclosed publicly. Multiple so...

CVE-2025-7111

Portabilis i-Educar 2.9.0 is affected in the Course Module, specifically file /intranet/educar_curso_det.php?cod_curso=ID. The vulnerability arises from unsafely handling the Curso parameter, enabling cross-site scripting (XSS). Attacks are possible remotely, and public exploits have been disclos...

CVE-2025-10608

CVE-2025-10608 affects Portabilis i-Educar up to 2.10. The vulnerability arises from manipulation of an unknown function in the /enrollment-history/ file, causing improper access controls. Exploitation is possible remotely, and exploit code/public information exists according to multiple sources....

CVE-2025-9720

Portabilis i-Educar up to 2.10 is affected. The vulnerability lies in the /module/TabelaArredondamento/edit component (Cadastrar tabela de arredundamento Page) where manipulating the Nome argument enables cross-site scripting. The issue can be exploited remotely and exploits are public. Remediati...

CVE-2025-8789

CVE-2025-8789 affects Portabilis i-Educar up to version 2.9.0. The vulnerability resides in the API Endpoint Diario component (/module/Api/Diario) and is caused by an authorization bypass, enabling remote exploitation. Public exploits have been disclosed. Multiple sources (Red Hat, NVD/NVD-derive...

CVE-2025-10070

CVE-2025-10070 affects Portabilis i-Educar up to version 2.10, where an improper access control flaw exists in an unknown area of the file /enturmacao-em-lote/. The issue can be triggered remotely and has publicly published exploit code (PoC). Multiple sources (including PT-2025-36417) recommend ...

CVE-2025-65022

CVE-2025-65022 describes an authenticated time-based SQL injection in i-Educar up to version 2.10.0, in the intranet/agenda.php script. The issue arises from the cod_agenda parameter being directly concatenated into SQL queries without sanitization, allowing an authenticated user to execute arbit...

CVE-2025-7866

Portabilis i-Educar 2.9.0 is affected. The Vulnerability lies in the Disabilities Module via the file /intranet/educar_deficiencia_lst.php, where the Deficiência ou Transtorno parameter can be manipulated to trigger cross-site scripting. The issue can be exploited remotely and the exploit has bee...

CVE-2026-2064

CVE-2026-2064 affects Portabilis i-Educar up to version 2.10. The vulnerability is in the file /intranet/meusdadod.php of the User Data Page, where manipulation of the File argument leads to cross-site scripting. It can be exploited remotely and a public exploit exists. Multiple sources confirm t...

CVE-2025-10074

Portabilis i-Educar (up to 2.10) contains a cross-site scripting (XSS) vulnerability in an unknown function of the /usuarios/tipos/ file. The issue arises from manipulation of the argument Tipos de Usuário/Descrição, allowing remote exploitation. Public exploit availability is noted. Mitigation/R...

CVE-2025-7868

Portabilis i-Educar Calendar module vulnerability (CVE-2025-7868) allows remote cross-site scripting via the Motivo/descricao argument in /intranet/educar_calendario_dia_motivo_cad.php. Affected versions range up to 2.10; one source specifies version 2.9.0. The exploit is publicly disclosed. Root...

CVE-2025-8543

Portabilis i-Educar 2.10 contains a cross-site scripting vulnerability in the /intranet/educar_raca_cad.php file, triggered by manipulating the nm_raca parameter. The issue is exploitable remotely, with public exploit disclosures noted across multiple sources. Affected component is the educar_rac...

CVE-2025-10073

CVE-2025-10073 affects Portabilis i-Educar up to version 2.10. The vulnerability resides in an unknown function in the file /module/Api/turma and can lead to improper authorization when manipulated. Exploitation can be performed remotely, and public disclosures of the exploit are noted. Several c...

CVE-2025-11047

CVE-2025-11047 affects Portabilis i-Educar up to version 2.10. A weakness exists where manipulating the argument aluno_id in an unknown function of /module/Api/aluno causes improper authorization. The issue can be triggered remotely and, per multiple sources, the exploit has been made publicly av...

CVE-2025-7867

CVE-2025-7867 affects Portabilis i-Educar 2.9.0/2.10.0, specifically the Agenda Module’s file /intranet/agenda.php. The vulnerability arises from manipulating the parameters novo_titulo and novo_descricao, leading to cross-site scripting. Attacks can be initiated remotely, and the exploit has bee...

CVE-2025-8509

Portabilis i-Educar 2.9 is affected. The vulnerability exists in the /intranet/educar_servidor_cad.php file where manipulation of the matricula argument leads to cross-site scripting (XSS). The issue can be exploited remotely, and public proof-of-concept material has been disclosed. Several conne...

CVE-2025-8538

CVE-2025-8538 affects Portabilis i-Educar 2.10. The vulnerability exists in the unknown function at /usuarios/tipos/novo where manipulating the name/description parameter triggers cross-site scripting. It can be exploited remotely; the exploit has been disclosed. Vendor did not respond to disclos...

CVE-2025-8918

Portabilis i-Educar (up to 2.10) is affected by a Cross-Site Scripting (XSS) in the Editar Page component, via manipulation of the neighborhood name parameter in /intranet/educar_instituicao_cad.php. CVE-2025-8918 can be exploited remotely, with exploit publicized. Affected versions: Portabilis i...

CVE-2025-8784

Portabilis i-Educar (up to 2.9) is affected by a cross-site scripting vulnerability in the Cadastrar Vínculo Page, due to manipulation of the nome parameter in /intranet/funcionario_vinculo_cad.php. The issue can be exploited remotely, and public disclosures exist. Remediation: upgrade to a newer...

CVE-2025-8368

CVE-2025-8368 affects Portabilis i-Educar 2.9. The vulnerability is a reflected cross-site scripting in the file /intranet/pesquisa_pessoa_lst.php, caused by manipulation of the argument campo_busca/cpf. It can be triggered remotely and, per the sources, the exploit has been publicly disclosed. M...

CVE-2025-8540

CVE-2025-8540 affects Portabilis i-Educar 2.10. The vulnerability resides in the file /intranet/public_municipio_cad.php where the nome parameter can be manipulated to trigger a cross-site scripting (XSS) condition. The attack can be initiated remotely, and the exploit has been publicly disclosed...

CVE-2025-8785

CVE-2025-8785 affects Portabilis i-Educar up to 2.9. The issue is a Cross-Site Scripting (XSS) vulnerability in the endpoint /intranet/educar_usuario_lst.php caused by improper handling of the nm_pessoa/matricula/matricula_interna parameters. An attacker can remotely trigger the flaw, and public ...

CVE-2025-10072

CVE-2025-10072 affects Portabilis i-Educar up to version 2.10. The issue is described as an improper access control vulnerability in processing of the file path /matricula/[ID_STUDENT]/enturmar/, enabling a remote attacker to manipulate processing. Public exploitation is noted in multiple sources...

CVE-2025-7112

Portabilis i-Educar 2.9.0, Function Management Module, has a cross-site scripting (XSS) vulnerability in the educar_funcao_det.php endpoint caused by unsafely manipulating the Função parameter (cod_funcao/ref_cod_instituicao). The issue can be triggered remotely and is publicly disclosed. Multipl...

CVE-2025-7113

Portabilis i-Educar 2.9.0 is affected. The vulnerability resides in the Curricular Components Module, specifically the /module/ComponenteCurricular/edit endpoint where manipulating the Nome parameter enables a cross-site scripting (XSS) flaw. It can be triggered remotely, with public exploit disc...

CVE-2025-8542

CVE-2025-8542 affects Portabilis i-Educar 2.10. The vulnerability lies in processing of the file /intranet/empresas_cad.php where manipulation of the argument fantasia/razao_social enables cross-site scripting. Exploitation can be remote and public exploits have been disclosed. Multiple sources c...

CVE-2025-10605

Portabilis i-Educar up to version 2.10 contains a cross-site scripting (XSS) vulnerability in the /agenda_preferencias.php file, caused by improper handling of the tipoacao parameter. The issue can be triggered remotely and has publicly available exploits. Affected systems should be updated to a ...

CVE-2025-7109

Portabilis i-Educar 2.9.0 contains a cross-site scripting vulnerability in the Student Benefits Registration component, specifically in the file /intranet/educar_aluno_beneficio_lst.php where manipulation of the Benefício parameter leads to XSS. The issue is exploitable remotely and public exploi...

CVE-2025-7110

CVE-2025-7110 affects Portabilis i-Educar 2.9.0, specifically the School Module’s /intranet/educar_escola_lst.php. The vulnerability arises from manipulating the Escola parameter, enabling cross-site scripting. Exploitation can be remote, and public disclosure has occurred; vendor reportedly did ...

CVE-2025-8507

CVE-2025-8507 affects Portabilis i-Educar 2.9. The vulnerability targets an unknown function in the file /intranet/educar_funcao_lst.php, where manipulating the nm_funcao/abreviatura parameter leads to cross-site scripting. It can be exploited remotely and an exploit has been disclosed publicly. ...

CVE-2025-8510

Portabilis i-Educar 2.10 is affected. The vulnerability is in the Gerar function of ieducar/intranet/educar_matricula_lst.php, where manipulating the ref_cod_aluno parameter enables cross-site scripting. The issue can be triggered remotely, with multiple sources noting public disclosure of the ex...

CVE-2025-10584

CVE-2025-10584 affects Portabilis i-Educar up to version 2.10. The vulnerability is a cross-site scripting flaw in the file /intranet/educar_calendario_anotacao_cad.php, caused by improper handling of the nm_anotacao/descricao parameter. It can be exploited remotely, and an exploit is publicly av...

CVE-2025-10591

CVE-2025-10591 affects Portabilis i-Educar up to version 2.10. The vulnerability is a cross-site scripting flaw in the Editar Função Page, specifically via manipulation of the abreviatura/tipoacao parameter in the file /intranet/educar_funcao_cad.php. This can be exploited remotely and appears to...

CVE-2025-7869

Portabilis i-Educar 2.9.0 is affected. The vulnerability is a cross-site scripting flaw in the Turma Module caused by unsanitized handling of the nm_tipo parameter in intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID. The issue can be exploited remotely and has been publicly disclosed; exploit...

CVE-2025-10606

CVE-2025-10606 affects Portabilis i-Educar up to 2.10, with a vulnerability in the file path /module/Configuracao/ConfiguracaoMovimentoGeral. The issue arises from manipulation of the argument tipoacao , enabling cross-site scripting (XSS). The description states that remote exploitation is possi...

CVE-2025-8366

CVE-2025-8366 affects Portabilis i-Educar 2.9. The vulnerability resides in the/educar_servidor_lst.php script, where manipulation of the nome/matricula_servidor parameter enables cross-site scripting. The attack can be launched remotely, and exploits have been publicly disclosed. Multiple source...

CVE-2025-8541

CVE-2025-8541 affects Portabilis i-Educar 2.10. The vulnerability is a cross-site scripting in /intranet/public_uf_cad.php triggered by manipulating the nome parameter. The attack can be initiated remotely and the exploit has been disclosed publicly; vendor response is noted as non-responsive. Th...

CVE-2025-8544

CVE-2025-8544 affects Portabilis i-Educar 2.10. The vulnerable component is an unknown functionality in the file /module/RegraAvaliacao/edit , where manipulation of the parameter nome leads to cross-site scripting (XSS) . The issue can be exploited remotely, and the exploit has been publicly disc...

CVE-2025-9721

Portabilis i-Educar

CVE-2025-10011

CVE-2025-10011 — Portabilis i-Educar up to 2.10 is documented to have a SQL injection vulnerability in an unknown function of the file /module/TabelaArredondamento/edit. The manipulation of the argument ID enables remote exploitation, and public exploits have been reported. The consolidated sourc...

CVE-2025-10012

Portabilis i-Educar up to 2.10 is affected by an SQL injection in educar_historico_escolar_lst.php via manipulation of the ref_cod_aluno parameter. The issue enables remote exploitation and has been publicly disclosed. Remediation per sources is to upgrade to a version newer than 2.10 or apply th...

CVE-2025-10373

Portabilis i-Educar up to version 2.10 is affected by a cross-site scripting (XSS) vulnerability in the /intranet/educar_turma_tipo_cad.php file. The issue arises from manipulation of the nm_tipo argument in an unknown function, allowing remote exploitation after interaction with the vulnerable p...