i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the ieducar/intranet/funcionariovinculodet.php file, which creates the query by concatenating the unsanitized GET parameter codfunc, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue.

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator (or another type with super-permissions) through a specifically crafted POST request to /intranet/educarusuariocad.php, modifying the nivelusuario parameter. The vulnerability occurs in the file located at ieducar/intranet/educarusuariocad.php, which does not check the user's current permission level before allowing changes. Commit c25910cdf11ab50e50162a49dd44bef544422b6e contains a patch for the issue.

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at ieducar/intranet/include/clsCampos.inc.php does not properly validate or sanitize user-controlled input, leading to the vulnerability. Any page that uses this implementation is vulnerable, such as intranet/educarcursolst.php?nmcurso=<payload>, intranet/atendidoslst.php?nmpessoa=<payload>, intranet/educarabandonotipolst?nome=<payload>. Commit f2d768534aabc09b2a1fc8a5cc5f9c93925cb273 contains a patch for the issue.