CVE-2025-10074

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-10074
A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.12 is sufficient to fix this issue. The identifier of the patch is 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. It is recommended to upgrade the affected component.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md Exploit Third Party Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md Broken Link
https://github.com/portabilis/i-educar/
https://github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9
https://github.com/portabilis/i-educar/tree/2.12
https://vuldb.com/cve/CVE-2025-10074
https://vuldb.com/submit/644137
https://vuldb.com/submit/702974
https://vuldb.com/vuln/323022
https://vuldb.com/vuln/323022/cti
Configurations

Configuration 1 (hide)

cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*
History

20 Oct 2026, 22:17

Type Values Removed Values Added
Summary (en) A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. (en) A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.12 is sufficient to fix this issue. The identifier of the patch is 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. It is recommended to upgrade the affected component.
References
  • {'url': 'https://vuldb.com/?ctiid.323022', 'tags': ['Permissions Required', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?id.323022', 'tags': ['Third Party Advisory', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?submit.644137', 'tags': ['Third Party Advisory', 'VDB Entry'], 'source': 'cna@vuldb.com'}
  • () https://github.com/portabilis/i-educar/ -
  • () https://github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9 -
  • () https://github.com/portabilis/i-educar/tree/2.12 -
  • () https://vuldb.com/cve/CVE-2025-10074 -
  • () https://vuldb.com/submit/644137 -
  • () https://vuldb.com/submit/702974 -
  • () https://vuldb.com/vuln/323022 -
  • () https://vuldb.com/vuln/323022/cti -
Information

Published : 2025-09-08 01:15

Updated : 2026-10-20 22:17

NVD link : CVE-2025-10074

Mitre link : CVE-2025-10074

CVE.ORG link : CVE-2025-10074

JSON object : View

Products Affected

portabilis

  • i-educar
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')