CVE-2025-2335

Name of the Vulnerable Software and Affected Versions Drivin Soluções up to 20250226

Description A vulnerability was found in Drivin Soluções, affecting the /api/school/registerSchool API endpoint of the API Handler component. The manipulation of the message argument leads to cross-site scripting. The attack can be initiated remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For Drivin Soluções up to 20250226, as a temporary workaround, consider restricting access to the /api/school/registerSchool API endpoint until a patch is available. Avoid using the message argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.