CVE-2025-9609 - Portabilis i-Educar consulta improper authorization

Back Back to CVE browser

MEDIUM

Portabilis i-Educar consulta improper authorization

Published Aug 29, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.

Affected products

Vendor Portabilis Product i-Educar Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.10
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -
- Version
  2.5
  Status
  affected
  Constraints
  -
- Version
  2.6
  Status
  affected
  Constraints
  -
- Version
  2.7
  Status
  affected
  Constraints
  -
- Version
  2.8
  Status
  affected
  Constraints
  -
- Version
  2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Portabilis

i-Educar

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.10	affected	-
2.2	affected	-
2.3	affected	-
2.4	affected	-
2.5	affected	-
2.6	affected	-
2.7	affected	-
2.8	affected	-
2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (5)

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%E2%80%93%20Missing%20Function-Level%20Access%20Control%20in%20%60.educacenso.consulta%60%20Endpoint.md#poc
exploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9609.md
relatedExploitThird Party Advisory
https://vuldb.com/?ctiid.321787
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321787
vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.636580
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%E2%80%93%20Missing%20Function-Level%20Access%20Control%20in%20%60.educacenso.consulta%60%20Endpoint.md#poc		exploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9609.md		relatedExploitThird Party Advisory
https://vuldb.com/?ctiid.321787		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321787		vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.636580		third-party-advisoryThird Party AdvisoryVDB Entry