CVE-2025-8366: Portabilis i-Educar educar_servidor_lst.php cross site scripting

Published Jul 31, 2025

Updated

A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educarservidorlst.php. The manipulation of the argument nome/matriculaservidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Portabilis i-Educar

Portabilis i-Educar=2.9.0

Event History

Jul 31, 2025

CVE Published

via MITRE·04:32 AM

Data Sourced

via MITRE·04:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Jun 19, 58473

Event

via NVD·10:39 PM

Frequently Asked Questions

What is the severity of CVE-2025-8366?

CVE-2025-8366 is rated as problematic due to its cross-site scripting capabilities.

How do I fix CVE-2025-8366?

To fix CVE-2025-8366, it's recommended to sanitize user inputs and correctly validate arguments in the affected functionality.

What components are affected by CVE-2025-8366?

CVE-2025-8366 affects the file /intranet/educar_servidor_lst.php within Portabilis i-Educar.

What type of vulnerability is CVE-2025-8366?

CVE-2025-8366 is classified as a cross-site scripting (XSS) vulnerability.

Is my version of Portabilis i-Educar vulnerable to CVE-2025-8366?

Portabilis i-Educar version 2.9 is vulnerable to CVE-2025-8366 as it contains the affected functionality.