CVE-2025-8920

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario version 1.6

Description: A vulnerability exists in Portabilis i-Diario 1.6 within the Dicionário de Termos BNCC Page component. Manipulation of the Planos de ensino argument in the /dicionario-de-termos-bncc file leads to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /dicionario-de-termos-bncc file. Sanitize the Planos de ensino argument to prevent script injection.