CVE-2025-65022 HIGH

CVE-2025-65022: i-Educar Authenticated Time-based SQL Injection in `agenda.php`

Vendor Portabilis
Product i-educar
Weakness CWE-89 · SQLi
Published November 19, 2025
Last update November 19, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.

Key dates

02Disclosure timeline

November 19, 2025 CVE published
November 19, 2025 Record updated