Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
94 results · page 2 of 2
Aug 27, 2025A flaw has been found in Portabilis i-Educar up to 2.10.CVE-2025-9532 · Other software · Portabilis · reported by VulDBLow 2.1
A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 27, 2025A vulnerability was detected in Portabilis i-Educar up to 2.10.CVE-2025-9531 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. It is suggested to upgrade the affected component. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkarinagante.github.io
Aug 20, 2025A vulnerability has been found in Portabilis i-Educar up to 2.10.CVE-2025-9236 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 mitigates this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-8918 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in Portabilis i-Educar up to 2.9.0.CVE-2025-8790 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api/pessoa of the component API Endpoint. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in Portabilis i-Educar up to 2.9.0.CVE-2025-8789 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diario of the component API Endpoint. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9.CVE-2025-8785 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. This issue affects some unknown processing of the file /intranet/educar_usuario_lst.php. The manipulation of the argument nm_pessoa/matricula/matricula_interna leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9.CVE-2025-8784 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9. This vulnerability affects unknown code of the file /intranet/funcionario_vinculo_cad.php of the component Cadastrar Vínculo Page. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10.CVE-2025-8545 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation of the argument nm_motivo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 5, 2025A vulnerability classified as problematic was found in Portabilis i-Educar 2.10.CVE-2025-8544 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 5, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10.CVE-2025-8543 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 5, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8542 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8541 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8540 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A weakness has been identified in Portabilis i-Educar 2.10.CVE-2025-8539 · Other software · Portabilis · reported by VulDBLow 1.9
A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 mitigates this issue. It is recommended to upgrade the affected component. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkarinagante.github.io
Aug 4, 2025A security flaw has been discovered in Portabilis i-Educar 2.10.CVE-2025-8538 · Other software · Portabilis · reported by VulDBLow 1.9
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkarinagante.github.io
Aug 3, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10.CVE-2025-8510 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8509 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8508 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8507 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.CVE-2025-8370 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escolaridade_lst.php. The manipulation of the argument descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.CVE-2025-8369 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intranet/educar_avaliacao_desempenho_lst.php. The manipulation of the argument titulo_avaliacao leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability classified as problematic was found in Portabilis i-Educar 2.9.CVE-2025-8368 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9.CVE-2025-8367 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8366 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_servidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8365 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10.CVE-2025-8346 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /educar_aluno_lst.php. The manipulation of the argument ref_cod_matricula with the input "><img%20src=x%20onerror=alert(%27CVE-Hunters%27)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0.CVE-2025-7869 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma Module. The manipulation of the argument nm_tipo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-7868 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0.CVE-2025-7867 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Portabilis i-Educar 2.9.0.CVE-2025-7866 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of the argument Deficiência ou Transtorno leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A vulnerability was found in Portabilis i-Educar 2.9.0.CVE-2025-7113 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCurricular/edit?id=ID of the component Curricular Components Module. The manipulation of the argument Nome leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic.CVE-2025-7112 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_funcao_det.php?cod_funcao=COD&ref_cod_instituicao=COD of the component Function Management Module. The manipulation of the argument Função leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic.CVE-2025-7111 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar_curso_det.php?cod_curso=ID of the component Course Module. The manipulation of the argument Curso leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0.CVE-2025-7110 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_lst.php of the component School Module. The manipulation of the argument Escola leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0.CVE-2025-7109 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file /intranet/educar_aluno_beneficio_lst.php of the component Student Benefits Registration. The manipulation of the argument Benefício leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025i-Educar is free, fully online school management software.CVE-2024-55651 · Other software · portabilis · reported by GitHubLow 2
i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2024A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9.CVE-2024-12893 · Other software · Portabilis · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of the file /usuarios/tipos/2 of the component Tipo de Usuário Page. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious CVE-2024-55239 · Other software · Portabilis · reported by MITREMedium 5.4
A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter.
- Product
- I-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.CVE-2024-48325 · Other software · portabilis · reported by MITREHigh 8.1
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45059 · Other software · portabilis · reported by GitHubHigh 8.8
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45058 · Other software · portabilis · reported by GitHubHigh 8.1
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator (or another type with super-permissions) through a specifically crafted POST request to `/intranet/educar_usuario_cad.php`, modifying the `nivel_usuario_` parameter. The vulnerability occurs in the file located at `ieducar/intranet/educar_usuario_cad.php`, which does not check the user's current permission level before allowing changes. Commit c25910cdf11ab50e50162a49dd44bef544422b6e contains a patch for the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45057 · Other software · portabilis · reported by GitHubMedium 6.1
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2023A vulnerability was detected in Portábilis i-Educar up to 2.7.5.CVE-2023-5578 · Other software · Portábilis · reported by VulDBLow 2
A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.