CVE-2024-55651: falha de baixa gravidade em portabilis i-educar
i-Educar Stored Cross-Site Scripting vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2epss 0.3%
i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Produtos afetados
portabilis · i-educarCVEs relacionadas — portabilis i-educar
No mesmo produto, das mais perigosas para as menos.
CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-45059HIGHAuthenticated SQL Injection in i-EducarEPSS 0.7%CVE-2025-65023HIGHi-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`EPSS 0.4%CVE-2025-65024HIGHi-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`EPSS 0.4%CVE-2024-45057MEDIUMReflected Cross-Site Scripting in i-EducarEPSS 0.4%CVE-2025-65022HIGHi-Educar Authenticated Time-based SQL Injection in `agenda.php`EPSS 0.3%