CVE-2025-9638: i-Educar 2.10.0 - Stored Cross-Site Scripting (XSS) in admin panel
Published Dec 9, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matriculainterna parameter in the educarusuariocad.php endpoint. This issue affects i-Educar: 2.10.0.
Affected Software
2 affected components
Portabilis i-Educar
Portabilis i-Educar=2.10.0
Event History
Dec 9, 2025
CVE Published
via MITRE·03:59 PM
Data Sourced
via MITRE·03:59 PM
DescriptionWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeaknessAffected Software
Feb 11, 58000
Event
via FIRST·07:08 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9638?
CVE-2025-9638 is categorized as a medium severity vulnerability due to its potential for stored XSS attacks.
2
How do I fix CVE-2025-9638?
To mitigate CVE-2025-9638, validate and sanitize the input from the matricula_interna parameter before using it in your application.
3
What type of vulnerability is CVE-2025-9638?
CVE-2025-9638 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
4
Which software versions are affected by CVE-2025-9638?
CVE-2025-9638 affects Portabilis i-Educar version 2.10.0.
5
Where can CVE-2025-9638 be exploited?
CVE-2025-9638 can be exploited through the educar_usuario_cad.php endpoint.