CVE-2025-8507: Portabilis i-Educar educar_funcao_lst.php cross site scripting

Published Aug 3, 2025

Updated

A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educarfuncaolst.php. The manipulation of the argument nmfuncao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Portabilis i-Educar

Portabilis i-Educar=2.9.0

Event History

Aug 3, 2025

CVE Published

via MITRE·10:02 AM

Data Sourced

via MITRE·10:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Jun 19, 58473

Event

via NVD·11:24 PM

Frequently Asked Questions

What is the severity of CVE-2025-8507?

CVE-2025-8507 has been classified as a problematic vulnerability.

What type of vulnerability is CVE-2025-8507?

CVE-2025-8507 is categorized as a cross-site scripting (XSS) vulnerability.

How do I fix CVE-2025-8507?

To fix CVE-2025-8507, sanitize and validate user inputs in the affected function to prevent XSS attacks.

Which software is affected by CVE-2025-8507?

CVE-2025-8507 affects Portabilis i-Educar version 2.9.

What is the attack vector for CVE-2025-8507?

The attack vector for CVE-2025-8507 involves exploiting the nm_funcao/abreviatura argument in the /intranet/educar_funcao_lst.php file.