CVE-2025-9684 - Portabilis i-Educar Formula de Cálculo de Média edit sql injection

Back Back to CVE browser

MEDIUM

Portabilis i-Educar Formula de Cálculo de Média edit sql injection

Published Aug 30, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products

Vendor Portabilis Product i-Educar Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.10
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -
- Version
  2.5
  Status
  affected
  Constraints
  -
- Version
  2.6
  Status
  affected
  Constraints
  -
- Version
  2.7
  Status
  affected
  Constraints
  -
- Version
  2.8
  Status
  affected
  Constraints
  -
- Version
  2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Portabilis

i-Educar

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.10	affected	-
2.2	affected	-
2.3	affected	-
2.4	affected	-
2.5	affected	-
2.6	affected	-
2.7	affected	-
2.8	affected	-
2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26266
Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9684.md
exploitrelatedThird Party Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.FormulaMedia.edit%60%20Endpoint.md
exploitBroken Link
https://vuldb.com/?ctiid.321896
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321896
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638574
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26266		Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9684.md		exploitrelatedThird Party Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.FormulaMedia.edit%60%20Endpoint.md		exploitBroken Link
https://vuldb.com/?ctiid.321896		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321896		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638574		third-party-advisoryThird Party AdvisoryVDB Entry