Cross Site Scripting in Portabilis i-Educar 2.9.0

CVE-2025-7113

What is CVE-2025-7113?

A cross site scripting vulnerability exists in the Curricular Components Module of Portabilis i-Educar 2.9.0. The vulnerability is triggered through unsanitized input in the 'Nome' argument of the edit function located at /module/ComponenteCurricular/edit?id=ID. Attackers can exploit this flaw remotely, enabling them to inject malicious scripts into the affected web application. This vulnerability poses a significant risk as it could lead to the manipulation of client-side scripts and the capture of sensitive user information. Despite early disclosure to the vendor by security researchers, there has been no official response concerning mitigation.

References