CVE-2025-10013

MediumCVSS 6.3/10Last modified Oct 20, 2026

Description

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. The patch is named d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2025
Last modified
Oct 20, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-100143.1A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the compCVE-2025-100154.8The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A locaCVE-2025-100168.8The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker CVE-2025-100184.8QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can injCVE-2025-100196.5Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting IncoCVE-2025-10025.3MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackCVE-2025-100208.8Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom ScripCVE-2025-100217.0A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static objectCVE-2025-100234.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ServCVE-2025-100247.5Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System CVE-2025-100259.8A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.phpCVE-2025-100266.1A vulnerability was found in itsourcecode POS Point of Sale System 1.0. Affected by this vulnerability is an unknown functionality of the fi
CVE-2025-10013: Medium severity, CVSS 6.3 | Vulnix