Vulnerability · Published Aug 3, 2025 · Assigned by VulDB

CVE-2025-8510Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in i-Educar from Portabilis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.

Affected products (as reported)

Vendor	Product	Versions
Portabilis	i-Educar	2.10

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References

VDB-318609 | Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting vdb-entry, technical-description
VDB-318609 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #618964 | Portabilis i-Educar 2.10 Cross Site Scripting third-party-advisory
https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md exploit
https://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg patch
https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46 patch