CVE-2026-2064: Portabilis i-Educar User Data meusdadod.php cross site scripting
A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2064?
CVE-2026-2064 is classified as a cross-site scripting vulnerability that can lead to the execution of malicious scripts in the user’s browser.
How do I fix CVE-2026-2064?
To fix CVE-2026-2064, ensure that you update Portabilis i-Educar to version 2.11 or later which includes mitigations for this vulnerability.
What components are affected by CVE-2026-2064?
CVE-2026-2064 affects the User Data Page component located in the /intranet/meusdadod.php file of Portabilis i-Educar up to version 2.10.
What could happen if CVE-2026-2064 is exploited?
If CVE-2026-2064 is exploited, attackers may execute arbitrary scripts in the context of a user's session, which can lead to data theft or session hijacking.
Is there a workaround for CVE-2026-2064 until I can apply a fix?
A temporary workaround for CVE-2026-2064 includes sanitizing user input to prevent script injection, but this is not a substitute for updating to the latest version.