CVE-2025-9687 - Portabilis i-Educar processamentoApi improper authorization

Back Back to CVE browser

MEDIUM

Portabilis i-Educar processamentoApi improper authorization

Published Aug 30, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.

Affected products

Vendor Portabilis Product i-Educar Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.10
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -
- Version
  2.5
  Status
  affected
  Constraints
  -
- Version
  2.6
  Status
  affected
  Constraints
  -
- Version
  2.7
  Status
  affected
  Constraints
  -
- Version
  2.8
  Status
  affected
  Constraints
  -
- Version
  2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Portabilis

i-Educar

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.10	affected	-
2.2	affected	-
2.3	affected	-
2.4	affected	-
2.5	affected	-
2.6	affected	-
2.7	affected	-
2.8	affected	-
2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (5)

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20students%20via%20.module.HistoricoEscolar.processamentoApi.md
broken-linkexploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9687.md
exploitrelatedThird Party Advisory
https://vuldb.com/?ctiid.321899
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321899
vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638582
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20students%20via%20.module.HistoricoEscolar.processamentoApi.md		broken-linkexploitBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9687.md		exploitrelatedThird Party Advisory
https://vuldb.com/?ctiid.321899		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.321899		vdb-entryThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638582		third-party-advisoryThird Party AdvisoryVDB Entry