CVE-2025-8785: Portabilis i-Educar educar_usuario_lst.php cross site scripting
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. This issue affects some unknown processing of the file /intranet/educarusuariolst.php. The manipulation of the argument nmpessoa/matricula/matriculainterna leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8785?
CVE-2025-8785 is classified as problematic due to its potential to lead to cross-site scripting (XSS).
How do I fix CVE-2025-8785?
To fix CVE-2025-8785, update Portabilis i-Educar to the latest version beyond 2.9.1, which addresses this vulnerability.
What vulnerabilities does CVE-2025-8785 exploit?
CVE-2025-8785 exploits an issue in the processing of the nm_pessoa, matricula, and matricula_interna arguments in the file /intranet/educar_usuario_lst.php.
Which software versions are affected by CVE-2025-8785?
CVE-2025-8785 affects all versions of Portabilis i-Educar up to and including version 2.9.
What are the potential impacts of CVE-2025-8785?
The potential impacts of CVE-2025-8785 include unauthorized execution of scripts in the user’s browser, leading to theft of session cookies or defacement.