Marceloqz

**Name of the Vulnerable Software and Affected Versions** Mangati NovoSGA versions up to 2.2.12 **Description** A weakness exists in Mangati NovoSGA up to version 2.2.12 related to weak password requirements during user creation. The issue is located in the User Creation Page component, specifically within the `/novosga.users/new` file and involves manipulation of the `Senha/Confirmação da senha` argument. This can be exploited remotely, but requires a high level of complexity and is considered difficult to execute. The exploit has been published. The vendor was notified but did not respond. **Recommendations** Versions prior to 2.2.12 should be updated.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security issue exists in Portabilis i-Educar up to version 2.10 related to improper authorization. The issue is associated with an unknown functionality within the `/unificacao-aluno` file. Manipulation of this file can lead to unauthorized access. Remote exploitation is possible, and the exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A flaw exists in Portabilis i-Educar up to version 2.10, related to improper authorization. The issue affects an unknown part of the file `/periodo-lancamento`. Manipulation of this file can lead to unauthorized access. The attack can be executed remotely. **Recommendations** Update Portabilis i-Educar to a version newer than 2.10.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A weakness exists in Portabilis i-Educar up to version 2.10, related to improper authorization. The issue is triggered by manipulating the `aluno id` argument within an unknown function of the `/module/Api/aluno` file. This manipulation can be initiated remotely. The exploit has been publicly released. **Recommendations** Update to a version beyond 2.10.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security issue exists in Portabilis i-Educar. The issue involves improper authorization due to manipulation of an unknown functionality within the file `/consulta-dispensas`. This manipulation can be initiated remotely. The exploit for this issue has been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security flaw exists in Portabilis i-Educar up to version 2.10. The flaw is related to cross site scripting, triggered by manipulating the `ref pessoa` argument of an unknown function within the `/intranet/educar usuario det.php` file. This attack can be executed remotely. The exploit has been released publicly. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `/intranet/educar usuario det.php` file. Sanitize the `ref pessoa` argument to prevent the injection of malicious scripts.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A security issue has been identified in Portabilis i-Educar. The vulnerability involves an unknown function within the `/module/Avaliacao/diarioApi` file, leading to information disclosure. This issue can be exploited remotely. The exploit has been publicly disclosed. **Recommendations** Update Portabilis i-Educar to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue involves improper access controls due to manipulation of an unknown function within the `/enrollment-history/` file. This allows for remote exploitation. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security flaw has been discovered in Portabilis i-Educar. The vulnerability affects unknown code within the `/agenda preferencias.php` file. Manipulation of the `tipoacao` argument can lead to cross-site scripting. The attack can be launched remotely, and an exploit has been publicly released. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict or sanitize input to the `tipoacao` argument in the `/agenda preferencias.php` file.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A weakness exists in Portabilis i-Educar up to version 2.10. The issue is related to the manipulation of the `abreviatura/tipoacao` argument in the `/intranet/educar funcao cad.php` file within the Editar Função Page component, leading to a cross-site scripting condition. The attack can be carried out remotely. The exploit has been made publicly available. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `/intranet/educar funcao cad.php` file. Avoid using the `abreviatura/tipoacao` argument in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A weakness has been identified in Portabilis i-Educar that allows for cross site scripting. The issue affects unknown processing of the file `/module/Configuracao/ConfiguracaoMovimentoGeral`. Manipulation of the argument `tipoacao` can trigger the issue. Remote exploitation is possible, and the exploit has been made publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A weakness exists in Portabilis i-Educar up to version 2.10 related to cross site scripting. The issue is located in an unknown functionality of the file `/intranet/educar usuario cad.php` within the Editar usuário Page component. Manipulation of the arguments `email`, `data inicial`, and `data expiracao` can trigger the issue. The attack can be initiated remotely, and the exploit has been made publicly available. Recommendations: Versions prior to 2.11: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A cross site scripting issue exists in Portabilis i-Educar up to version 2.10. The issue is related to the manipulation of the `Tipos de Usuário/Descrição` argument within an unknown function of the `/usuarios/tipos/` file. This can be initiated remotely. **Recommendations** Update to version 2.11 or later. As a temporary workaround, restrict manipulation of the `Tipos de Usuário/Descrição` argument.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A flaw has been found in Portabilis i-Educar that allows for improper access controls. This issue affects an unknown part of the file `/enturmacao-em-lote/`. The attack is possible to be carried out remotely. The exploit has been published. **Recommendations** Update Portabilis i-Educar to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue involves improper authorization resulting from manipulation of an unknown function within the `/module/Api/turma` file. This allows for remote exploitation. The exploit has been publicly disclosed. **Recommendations** Update Portabilis i-Educar to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar that allows for improper access controls. This issue affects unknown code within the `/cancelar-enturmacao-em-lote/` API endpoint and can be exploited remotely. The exploit for this issue has been publicly disclosed. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `/cancelar-enturmacao-em-lote/` API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A vulnerability exists in Portabilis i-Educar versions up to 2.10 related to improper access controls resulting from manipulation of file processing. The affected file is `/matricula/[ID STUDENT]/enturmar/`. This issue can be initiated remotely. The exploit has been made public. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A weakness exists in Portabilis i-Educar up to version 2.10. The issue is related to SQL injection stemming from manipulation of the `ID` argument within an unknown function of the `/module/TabelaArredondamento/edit` file. Remote exploitation is possible, and the exploit has been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security issue has been identified in Portabilis i-Educar. Manipulation of the `ref cod aluno` argument in the `educar historico escolar lst.php` file can lead to SQL injection. This issue can be exploited remotely. The exploit has been publicly disclosed. **Recommendations** Versions prior to 2.10 should be updated. As a temporary workaround, restrict access to the `educar historico escolar lst.php` file to minimize the risk of exploitation. Avoid using the `ref cod aluno` parameter in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions prior to 2.11 **Description** A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue affects an unknown function within the `/exportacao-para-o-seb` file and results in improper access controls due to manipulation. The attack can be carried out remotely. **Recommendations** Update to version 2.11 or later.