CVE-2024-55651: i-Educar Stored Cross-Site Scripting vulnerability
First published: Wed May 07 2025(Updated: )
i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| i-Educar |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-55651?
CVE-2024-55651 is classified as a medium severity vulnerability due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2024-55651?
To fix CVE-2024-55651, update i-Educar to the latest version that includes proper input validation and sanitization.
Which versions of i-Educar are affected by CVE-2024-55651?
CVE-2024-55651 affects i-Educar version 2.9 and is addressed in subsequent releases.
What type of vulnerability is CVE-2024-55651?
CVE-2024-55651 is a stored cross-site scripting vulnerability specifically related to the user type input field.
Can CVE-2024-55651 be exploited remotely?
Yes, CVE-2024-55651 can potentially be exploited remotely if an attacker is able to input malicious scripts into the vulnerable field.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/first-publish-date
- agent/references
- agent/title
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/source
- agent/author
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/i-educar
- canonical/i-educar