CVE-2025-9638

Medium CVSS: 4.8

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint.
This issue affects i-Educar: 2.10.0.

Vendor

Portabilis

Product

I-educar

CWE

CWE-79

Yayın Tarihi

2025-12-09 16:18:39

Güncelleme

2025-12-11 17:56:54

Source Identifier

help@fluidattacks.com

KEV Date Added

Kategoriler

CWE-79 I-educar MEDIUM Portabilis 2025

Referanslar

https://fluidattacks.com/advisories/travis https://github.com/portabilis/i-educar https://fluidattacks.com/advisories/travis

Benzer Kayıtlar

Medium

CVE-2026-2064

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functiona…

Medium

CVE-2026-2015

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatu…

High

CVE-2025-65022

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL…

High

CVE-2025-65023

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL…

High

CVE-2025-65024

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL…

Medium

CVE-2025-11554

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown f…