PT-2025-38244

CVE-2025-10606

Published

2025-09-17

Updated

2025-09-18

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10

Description A weakness has been identified in Portabilis i-Educar that allows for cross site scripting. The issue affects unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. Manipulation of the argument tipoacao can trigger the issue. Remote exploitation is possible, and the exploit has been made publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Marceloqz

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers