Cross-Site Scripting Vulnerability in Portabilis i-Educar Student Benefits Registration

CVE-2025-7109

What is CVE-2025-7109?

A cross-site scripting vulnerability has been identified in the Portabilis i-Educar application, specifically within the Student Benefits Registration component. The vulnerability is linked to an unspecified functionality associated with the file /intranet/educar_aluno_beneficio_lst.php, where the manipulation of the Benefício argument allows attackers to execute scripts in the context of the user's browser. This exploitation can occur remotely, posing significant risks as the exploit has been disclosed publicly. Despite attempts to notify the vendor, no response has been received, highlighting the urgency for users to be aware of this security concern.

References