Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65024 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit 3e9763a.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65023 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_funcionario_vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit a00dfa3.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65022 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025i-Educar is free, fully online school management software.CVE-2024-55651 · Other software · portabilis · reported by GitHubLow 2
i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025A vulnerability was found in Itechscripts School Management Software 2.75.CVE-2017-20196 · Other software · Itechscripts · reported by VulDBMedium 5.3
A vulnerability was found in Itechscripts School Management Software 2.75. It has been classified as critical. This affects an unknown part of the file /notice-edit.php. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- School Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45059 · Other software · portabilis · reported by GitHubHigh 8.8
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheatsheetseries.owasp.orggithub.com
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45058 · Other software · portabilis · reported by GitHubHigh 8.1
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator (or another type with super-permissions) through a specifically crafted POST request to `/intranet/educar_usuario_cad.php`, modifying the `nivel_usuario_` parameter. The vulnerability occurs in the file located at `ieducar/intranet/educar_usuario_cad.php`, which does not check the user's current permission level before allowing changes. Commit c25910cdf11ab50e50162a49dd44bef544422b6e contains a patch for the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers.CVE-2024-45057 · Other software · portabilis · reported by GitHubMedium 6.1
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at `ieducar/intranet/include/clsCampos.inc.php` does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as `intranet/educar_curso_lst.php?nm_curso=<payload>`, `intranet/atendidos_lst.php?nm_pessoa=<payload>`, `intranet/educar_abandono_tipo_lst?nome=<payload>`. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2024Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via CVE-2024-27717 · Other software · eskooly · reported by MITREMedium 6.5
Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via the Token Handling component.
- Product
- web_product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jul 5, 2024An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the PassworCVE-2024-27715 · Other software · eskooly · reported by MITREHigh 8.2
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism.
- Product
- web_product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jul 5, 2024An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header SettingCVE-2024-27713 · Other software · eskooly · reported by MITREHigh 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component.
- Product
- web_product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jul 5, 2024An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt componCVE-2024-27712 · Other software · Eskooly · reported by MITRECritical 9.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Account Mangemnt component in the authentication mechanism.
- Product
- Eskooly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jul 5, 2024An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in tCVE-2024-27711 · Other software · eskooly · reported by MITREHigh 8.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in the account settings.
- Product
- free_online_school_management_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jul 5, 2024An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism.CVE-2024-27710 · Other software · eskooly · reported by MITRECritical 9.8
An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authentication mechanism.
- Product
- free_online_school_management_software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.be-hacktive.comblog.be-hacktive.com
Jan 31, 2020School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.CVE-2020-8505 · Other software · Arox · reported by MITREMedium 6.5
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
- Product
- School Management Software Php/mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2020School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.CVE-2020-8504 · Other software · Arox · reported by MITREMedium 6.5
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
- Product
- School Management Software Php/mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.