Portabilis i-Educar 2.10 educar_matricula_lst.php Gerar ref_cod_aluno Cross Site Scripting

Wuro vulnerability wey an yi classify sey karshewa an gano shi a cikin Portabilis i-Educar 2.10. Gaskiya, Gerar na da matsala; idan ba a sani ba, to wata aiki ce da ba a sani ba, $software_library na cikin lissafi, ieducar/intranet/educar_matricula_lst.php na cikin fayil, $software_component na cikin sashi. Ngam manipulation of the argument ref_cod_aluno shi Cross Site Scripting. CWE shidin ka a yi bayani matsala sai ya kai CWE-79. Gaskiya, laifi an fitar da shi 08/02/2025. Advisory ɗin ana rabawa don saukewa a github.com. Wannan rauni ana sayar da shi da suna CVE-2025-8510. Ngam yiɗi ka a tuma ndiyam ka nder internet. Tekinikal bayani ga. Kuma, exploit ɗin yana akwai. Wuro exploit ɗin an bayyana shi ga jama'a kuma za a iya amfani da shi. A sa'i, exploit might be approx. USD $0-$5k ndiyam. Á wúro huɗɗi-na-gaskiya. Wona yiwuwa a zazzage exploit a github.com. Kama 0-day, an ndiyam a wuro be $0-$5k. Patch ɗin sunan ganowa shine 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. Gyaran matsalar yana nan a shirye don saukewa a github.com. Ana so a yi patch don gyara wannan matsala. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

4 Goyarwa · 104 Datenpunkte

FurɗeSúgá
08/02/2025 17:26		Gargadi 1/3
08/03/2025 15:37		Gargadi 2/3
08/03/2025 17:22		Gargadi 3/3
08/13/2025 07:40
software_vendorPortabilisPortabilisPortabilisPortabilis
software_namei-Educari-Educari-Educari-Educar
software_version2.102.102.102.10
software_fileieducar/intranet/educar_matricula_lst.phpieducar/intranet/educar_matricula_lst.phpieducar/intranet/educar_matricula_lst.phpieducar/intranet/educar_matricula_lst.php
software_functionGerarGerarGerarGerar
software_argumentref_cod_alunoref_cod_alunoref_cod_alunoref_cod_aluno
vulnerability_cweCWE-79 (Cross Site Scripting)CWE-79 (Cross Site Scripting)CWE-79 (Cross Site Scripting)CWE-79 (Cross Site Scripting)
vulnerability_risk1111
cvss3_vuldb_avNNNN
cvss3_vuldb_acLLLL
cvss3_vuldb_uiRRRR
cvss3_vuldb_sUUUU
cvss3_vuldb_cNNNN
cvss3_vuldb_iLLLL
cvss3_vuldb_aNNNN
cvss3_vuldb_ePPPP
cvss3_vuldb_rlOOOO
cvss3_vuldb_rcCCCC
advisory_urlhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md
advisory_confirm_urlhttps://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xghttps://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xghttps://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xghttps://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg
exploit_availability1111
exploit_publicity1111
exploit_urlhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.mdhttps://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md
countermeasure_nameKariKariKariKari
patch_name82c288b9a4abb084bdfa1c0c4ef777ed45f98b4682c288b9a4abb084bdfa1c0c4ef777ed45f98b4682c288b9a4abb084bdfa1c0c4ef777ed45f98b4682c288b9a4abb084bdfa1c0c4ef777ed45f98b46
countermeasure_patch_urlhttps://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46
source_cveCVE-2025-8510CVE-2025-8510CVE-2025-8510CVE-2025-8510
cna_responsibleVulDBVulDBVulDBVulDB
response_summaryThe vendor initially closed the original advisory without requesting a CVE.The vendor initially closed the original advisory without requesting a CVE.The vendor initially closed the original advisory without requesting a CVE.The vendor initially closed the original advisory without requesting a CVE.
cvss2_vuldb_avNNNN
cvss2_vuldb_acLLLL
cvss2_vuldb_ciNNNN
cvss2_vuldb_iiPPPP
cvss2_vuldb_aiNNNN
cvss2_vuldb_ePOCPOCPOCPOC
cvss2_vuldb_rcCCCC
cvss2_vuldb_rlOFOFOFOF
cvss4_vuldb_avNNNN
cvss4_vuldb_acLLLL
cvss4_vuldb_uiPPPP
cvss4_vuldb_vcNNNN
cvss4_vuldb_viLLLL
cvss4_vuldb_vaNNNN
cvss4_vuldb_ePPPP
cvss2_vuldb_auSSSS
cvss3_vuldb_prLLLL
cvss4_vuldb_atNNNN
cvss4_vuldb_prLLLL
cvss4_vuldb_scNNNN
cvss4_vuldb_siNNNN
cvss4_vuldb_saNNNN
cvss2_vuldb_basescore4.04.04.04.0
cvss2_vuldb_tempscore3.13.13.13.1
cvss3_vuldb_basescore3.53.53.53.5
cvss3_vuldb_tempscore3.23.23.23.2
cvss3_meta_basescore3.53.53.54.1
cvss3_meta_tempscore3.23.33.34.0
cvss4_vuldb_bscore5.15.15.15.1
cvss4_vuldb_btscore2.02.02.02.0
advisory_date1754085600 (08/02/2025)1754085600 (08/02/2025)1754085600 (08/02/2025)1754085600 (08/02/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k
cve_nvd_summaryA vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.
cvss4_cna_avNNN
cvss4_cna_acLLL
cvss4_cna_atNNN
cvss4_cna_prLLL
cvss4_cna_uiPPP
cvss4_cna_vcNNN
cvss4_cna_viLLL
cvss4_cna_vaNNN
cvss4_cna_scNNN
cvss4_cna_siNNN
cvss4_cna_saNNN
cvss4_cna_bscore5.15.15.1
cvss3_cna_avNNN
cvss3_cna_acLLL
cvss3_cna_prLLL
cvss3_cna_uiRRR
cvss3_cna_sUUU
cvss3_cna_cNNN
cvss3_cna_iLLL
cvss3_cna_aNNN
cvss3_cna_basescore3.53.53.5
cvss2_cna_avNNN
cvss2_cna_acLLL
cvss2_cna_auSSS
cvss2_cna_ciNNN
cvss2_cna_iiPPP
cvss2_cna_aiNNN
cvss2_cna_basescore444
euvd_idEUVD-2025-23476EUVD-2025-23476
cve_nvd_summaryesSe ha encontrado una vulnerabilidad clasificada como problemática en Portabilis i-Educar 2.10. Esta afecta a la función Gerar del archivo ieducar/intranet/educar_matricula_lst.php. La manipulación del argumento ref_cod_aluno provoca ataques de Cross-Site Scripting. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. El identificador del parche es 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. Se recomienda aplicar un parche para solucionar este problema. El proveedor inicialmente cerró el aviso original sin solicitar una CVE.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiR
cvss3_nvd_sC
cvss3_nvd_cL
cvss3_nvd_iL
cvss3_nvd_aN
cvss3_nvd_basescore5.4

◂ GurɗoGumtiGada ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!