Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
Portabilis i-Educar 2.11: Remote Code Injection via Malicious Input
CVE-2026-4355
Summary
A security flaw in Portabilis i-Educar 2.11 allows an attacker to inject malicious code into the system when a user enters a specially crafted input. This could potentially allow an attacker to take control of the system. We recommend that users update to the latest version to fix this issue.
Original title
A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation o...
Original description
A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
4.0
nvd CVSS3.1
3.5
nvd CVSS4.0
5.1
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
CWE-94
Code Injection
Published: 18 Mar 2026 · Updated: 18 Mar 2026 · First seen: 18 Mar 2026