CVE-2025-7868: fallo de gravedad media en Portabilis i-Educar
Portabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Portabilis · i-EducarCVEs relacionadas — Portabilis i-Educar
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-8370MEDIUMPortabilis i-Educar educar_escolaridade_lst.php cross site scriptingEPSS 0.6%CVE-2025-8369MEDIUMPortabilis i-Educar educar_avaliacao_desempenho_lst.php cross site scriptingEPSS 0.6%CVE-2025-8368MEDIUMPortabilis i-Educar pesquisa_pessoa_lst.php cross site scriptingEPSS 0.6%CVE-2025-10011MEDIUMPortabilis i-Educar edit sql injectionEPSS 0.5%CVE-2025-8366MEDIUMPortabilis i-Educar educar_servidor_lst.php cross site scriptingEPSS 0.5%CVE-2024-12893MEDIUMPortabilis i-Educar Tipo de Usuário Page 2 cross site scriptingEPSS 0.5%