Vulnerability · Published May 7, 2025 · Assigned by GitHub_M

CVE-2024-55651i-Educar Stored Cross-Site Scripting vulnerability

Low 2.0

In plain English

A low-severity cross-site scripting in i-educar from portabilis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.

Affected products (as reported)

Vendor	Product	Versions
portabilis	i-educar	= 2.9

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References

https://github.com/portabilis/i-educar/security/advisories/GHSA-8fjj-9937-g84w x_refsource_CONFIRM