Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8507: Portabilis i-Educar lets attackers inject scripts on function list page

CVE-2025-8507 · published 1 year ago

Summary

The web page /intranet/educar_funcao_lst.php in Portabilis i-Educar version 2.9 allows a user‑supplied name or abbreviation to be displayed without proper cleaning. An attacker could send a specially crafted link that makes a browser run unwanted code when a staff member views the page, potentially stealing data or hijacking sessions. Apply the vendor’s security update or restrict access to the page and ensure input is properly filtered.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
portabilis	i-educar	2.9.0 `cpe:2.3:a:portabilis:i-educar:2.9.0:::::::*`

Original advisory text

Portabilis i-Educar educar_funcao_lst.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8507.md URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8507.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-8507 Vendor Advisory
https://vuldb.com/?id.318606 Vendor Advisory
https://vuldb.com/?submit.618677 Vendor Advisory
https://vuldb.com/?ctiid.318606 Third Party Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar... Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published3 Aug 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-8507 · NVD

CVE-2025-8507 · OSV

Track software like this

Free during beta