Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2025-8538: Portabilis i-Educar permits remote script injection
CVE-2025-8538 · published 1 year ago
Summary
The web page used for adding new user types in Portabilis i-Educar version 2.10 can be tricked into running unwanted code entered by an attacker. This could let a remote attacker insert malicious scripts that run in the browsers of anyone who views the page, potentially stealing information or taking control of sessions. Update the system to version 2.12, which fixes the problem, and apply the upgrade as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| portabilis | i-educar |
2.10 2.10.0 |
Original advisory text
Portabilis i-Educar novo cross site scripting
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
References
- https://vuldb.com/cve/CVE-2025-8538 Vendor Advisory
- https://vuldb.com/submit/620451 Vendor Advisory
- https://vuldb.com/vuln/318667 Vendor Advisory
- https://vuldb.com/vuln/318667/cti Third Party Advisory
- https://github.com/portabilis/i-educar/tree/2.12 Patch
- https://vuldb.com/?id.318667 Vendor Advisory
- https://vuldb.com/?ctiid.318667 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8538.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-8538 Vendor Advisory
- https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/CVE-2025-8538.md Exploit
- https://vuldb.com/?submit.620451 Exploit
- https://karinagante.github.io/cve-2025-8538/ Exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published5 Aug 2025
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta