CVE-2025-65023highCWE-89

CVE-2025-65023: falha de alta gravidade em portabilis i-educar

i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`

Publicada em

Seguir esta CVE+ Monitorar i-Educar

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.4%
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_funcionario_vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit a00dfa3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
portabilis · i-educar
CVEs relacionadas — portabilis i-educar

No mesmo produto, das mais perigosas para as menos.

CVE-2024-45058HIGHPrivilege escalation in i-EducarEPSS 1.4%CVE-2024-45059HIGHAuthenticated SQL Injection in i-EducarEPSS 0.7%CVE-2025-65024HIGHi-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`EPSS 0.4%CVE-2024-45057MEDIUMReflected Cross-Site Scripting in i-EducarEPSS 0.4%CVE-2025-65022HIGHi-Educar Authenticated Time-based SQL Injection in `agenda.php`EPSS 0.3%CVE-2024-55651LOWi-Educar Stored Cross-Site Scripting vulnerabilityEPSS 0.3%