CVE-2025-9236

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions prior to 2.10

Description: A vulnerability exists in Portabilis i-Diario up to version 2.10. The issue affects an unknown function within the /intranet/educar tipo usuario lst.php file of the Tipos de usàrio Page component. Manipulation of the nm tipo argument can lead to a SQL injection. The attack can be performed remotely. The exploit has been publicly disclosed and may be used. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: Portabilis i-Diario versions prior to 2.10: Restrict access to the /intranet/educar tipo usuario lst.php file and avoid using the nm tipo argument until a fix is available.