CVE-2025-65022highCWE-89

CVE-2025-65022: fallo de gravedad alta en portabilis i-educar

i-Educar Authenticated Time-based SQL Injection in `agenda.php`

Publicada el

Seguir esta CVE+ Monitorear i-Educar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 0.3%
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
portabilis · i-educar
CVEs relacionadas — portabilis i-educar

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-45059HIGHAuthenticated SQL Injection in i-EducarEPSS 0.7%CVE-2025-65023HIGHi-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`EPSS 0.4%CVE-2025-65024HIGHi-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`EPSS 0.4%CVE-2024-45057MEDIUMReflected Cross-Site Scripting in i-EducarEPSS 0.4%CVE-2024-55651LOWi-Educar Stored Cross-Site Scripting vulnerabilityEPSS 0.3%