CVE-2025-8920: Portabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scripting

Published Aug 13, 2025

Updated

A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of the component Dicionário de Termos BNCC Page. The manipulation of the argument Planos de ensino leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Portabilis i-Diario

Portabilis i-Diario=1.6

Event History

Aug 13, 2025

CVE Published

via MITRE·06:02 PM

Data Sourced

via MITRE·06:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Oct 5, 57909

Event

via FIRST·09:29 PM

Frequently Asked Questions

What is the severity of CVE-2025-8920?

CVE-2025-8920 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2025-8920?

To remediate CVE-2025-8920, implement input validation and sanitization in the handling of the Planos de ensino argument.

What systems are affected by CVE-2025-8920?

CVE-2025-8920 affects Portabilis i-Diario version 1.6.

What type of vulnerability is CVE-2025-8920?

CVE-2025-8920 is a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts.

Can CVE-2025-8920 be exploited remotely?

Yes, CVE-2025-8920 can be exploited remotely, making it critical for affected systems to be assessed for vulnerabilities.