CVE-2025-8542 MEDIUM

CVE-2025-8542: Portabilis i-Educar empresas_cad.php cross site scripting

Vendor Portabilis
Product i-Educar
Weakness CWE-79 · XSS
Published August 5, 2025
Last update August 7, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

August 5, 2025 CVE published
August 7, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-8740 GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting CVE-2024-13551 ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-23899 WordPress Bookalet plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-11892 DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers CVE-2025-32019 Harbor's repository description page allows for XSS