CVE-2025-9652 MEDIUM

CVE-2025-9652: Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting

Vendor Portabilis
Product i-Educar
Weakness CWE-79 · XSS
Published August 29, 2025
Last update August 29, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Key dates

02Disclosure timeline

August 29, 2025 CVE published
August 29, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-1354 SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System register.php cross site scripting CVE-2024-11707 My auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting CVE-2026-25482 Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) CVE-2023-45073 WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) CVE-2022-2823 Slider, Gallery, and Carousel by MetaSlider < 3.27.9 - Admin+ Stored Cross Site Scripting