Portabilis I-Educar vulnerabilities

CVE-2025-8543 [MEDIUM] CWE-79 CVE-2025-8543: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor wa

CVE-2025-10073 [MEDIUM] CWE-266 CVE-2025-10073: A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-8545 [MEDIUM] CWE-79 CVE-2025-8545: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Af A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation of the argument nm_motivo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to t

CVE-2025-8544 [MEDIUM] CWE-79 CVE-2025-8544: A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vu A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The v

CVE-2025-8541 [MEDIUM] CWE-79 CVE-2025-8541: A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vul A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor w

CVE-2025-8538 [MEDIUM] CWE-79 CVE-2025-8538: A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected b A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /usuarios/tipos/novo. The manipulation of the argument name/description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may

CVE-2025-8539 [MEDIUM] CWE-79 CVE-2025-8539: A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by thi A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. T

CVE-2025-8542 [MEDIUM] CWE-79 CVE-2025-8542: A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be use

CVE-2025-8540 [MEDIUM] CWE-79 CVE-2025-8540: A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This a A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The

CVE-2025-10099 [MEDIUM] CWE-79 CVE-2025-10099: A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuario_cad.php of the component Editar usuário Page. This manipulation of the argument email/data_inicial/data_expiracao causes cross site scripting. It is possible to initiate the attack remotely.

CVE-2024-45057 [MEDIUM] CWE-79 CVE-2024-45057: i-Educar is free, fully online school management software that can be used by school secretaries, te i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not pro

CVE-2024-55239 [MEDIUM] CWE-79 CVE-2024-55239: A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter.

CVE-2026-4355 [LOW] CWE-79 CVE-2026-4355: A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the fi A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted e

CVE-2025-9638 [MEDIUM] CWE-79 CVE-2025-9638: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.