CVE-2025-10844

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.

In i-Educar versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. The vulnerability is caused by improper handling of the cod_agenda GET parameter, which is directly concatenated into an SQL query without proper sanitization. The issue has been patched in commit 3e9763a.

In i-Educar versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. The vulnerability is caused by improper handling of the cod_funcionario_vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. The issue has been patched in commit a00dfa3.

i-Educar versions 2.10.0 and prior contain an authenticated time-based SQL injection vulnerability in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database due to improper handling of the cod_agenda parameter. This issue has been patched in commit b473f92.

A vulnerability was found in Portabilis i-Educar up to 2.10, involving improper access controls in the file /matricula/[ID_STUDENT]/enturmar/. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda_preferencias.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.

A vulnerability was detected in Portabilis i-Educar up to 2.10 in the file /intranet/agenda.php. Manipulation of the cod_agenda argument results in SQL injection. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 2.12 fixes this issue.

A vulnerability was found in Portabilis i-Educar up to 2.10 in the file /intranet/educar_tipo_usuario_lst.php. Manipulation of the nm_tipo/descrição arguments leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 2.12 fixes this issue.

A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 mitigates this issue. It is recommended to upgrade the affected component. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".

A vulnerability was detected in Portábilis i-Educar up to 2.7.5. Affected is an unknown function of the file \intranet\agenda_imprimir.php of the component HTTP GET Request Handler. The manipulation of the argument cod_agenda with the input ");'> <script>alert(document.cookie)</script> results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading the affected component is recommended. The vendor explains: "This endpoint and the associated functionality are no longer present in the current i-Educar codebase, as the affected area was removed from the product. As a result, the previously reported attack vector (...) is no longer applicable to versions in which this functionality has been removed."