Cross Site Scripting Vulnerability in Portabilis i-Educar Product

CVE-2025-8785

What is CVE-2025-8785?

A vulnerability has been identified in Portabilis i-Educar, specifically in the processing of the endpoint '/intranet/educar_usuario_lst.php'. By manipulating the parameters 'nm_pessoa', 'matricula', or 'matricula_interna', an attacker can exploit this vulnerability to perform cross site scripting attacks. This issue can be exploited remotely, which raises significant security concerns. Although the vendor was notified of this vulnerability, there has been no response, and the details have been publicly disclosed, potentially increasing the risk of exploitation.

References