CVE-2025-8787: Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting
A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /registros-de-conteudos-por-disciplina/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 821342cd8d952e8bd214cb16145da785a92f5681. A patch should be applied to remediate this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 821342cd8d952e8bd214cb16145da785a92f5681
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8787?
CVE-2025-8787 is classified as problematic due to its potential impact on the security of the Portabilis i-Diario application.
How do I fix CVE-2025-8787?
To fix CVE-2025-8787, it is recommended to update Portabilis i-Diario to version 1.5.1 or later where the vulnerability has been addressed.
What components are affected by CVE-2025-8787?
CVE-2025-8787 affects the functionality of the /registros-de-conteudos-por-disciplina/ component in Portabilis i-Diario.
What is the impact of exploiting CVE-2025-8787?
Exploitation of CVE-2025-8787 could potentially allow unauthorized manipulation of data within the affected component.
Is there a public exploit available for CVE-2025-8787?
As of now, there is no known public exploit for CVE-2025-8787, but it remains a concern for affected users.