Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.9
CVE-2025-10012: Portabilis i-Educar remote SQL injection via student ID
CVE-2025-10012 · published 1 year ago
Summary
The i-Educar system (versions up to 2.10) lets an attacker send a specially crafted student ID value to the file educar_historico_escolar_lst.php and run their own database commands. This could let a remote attacker view, change, or delete school records. Updating to version 2.12 or later fixes the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| portabilis | i-educar |
<= 2.10.0 2.0 cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:* |
Original advisory text
Portabilis i-Educar educar_historico_escolar_lst.php sql injection
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".
References
- https://vuldb.com/?id.322737 Vendor Advisory
- https://vuldb.com/?submit.643549 Vendor Advisory
- https://vuldb.com/?ctiid.322737 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10012... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-10012 Vendor Advisory
- https://github.com/portabilis/i-educar/tree/2.12 Patch
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10012.md URL
- https://vuldb.com/cve/CVE-2025-10012 Vendor Advisory
- https://vuldb.com/submit/643549 Vendor Advisory
- https://vuldb.com/vuln/322737 Vendor Advisory
- https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind... Exploit
- https://vuldb.com/vuln/322737/cti Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.9
High
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published5 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta