CVE-2025-8538: Portabilis i-Educar novo cross site scripting
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabilis i-Educar 2.10to a version that resolves this vulnerability.Fixed in 2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8538?
CVE-2025-8538 is classified as problematic due to its potential for allowing cross-site scripting attacks.
How do I fix CVE-2025-8538?
To fix CVE-2025-8538, ensure that input validation is implemented to sanitize the arguments name and description in the affected functionality.
What software versions are affected by CVE-2025-8538?
CVE-2025-8538 affects Portabilis i-Educar version 2.10.
What type of attack is associated with CVE-2025-8538?
CVE-2025-8538 is associated with Cross Site Scripting (XSS) attacks.
Where does CVE-2025-8538 occur within the software?
CVE-2025-8538 occurs in the file /usuarios/tipos/novo of the Portabilis i-Educar application.