CVE-2025-10844

HighCVSS 8.8/10Last modified Oct 11, 2026

Description

A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Portabilis	i-Educar	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10

References

https://karinagante.github.io/cve-2025-10844/
https://karinagante.github.io/cve-2025-10844/#proof-of-concept-poc
https://vuldb.com/?ctiid.325206Permissions Required, VDB Entry
https://vuldb.com/?id.325206Third Party Advisory, VDB Entry
https://vuldb.com/?submit.657687Third Party Advisory, VDB Entry

Timeline

Published: Sep 23, 2025
Last modified: Oct 11, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-108458.8A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The CVE-2025-108468.8A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurr CVE-2025-108478.4DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) compo CVE-2025-108488.8A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the fil CVE-2025-108495.3The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'proces CVE-2025-10854.3A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the fil CVE-2025-108509.8The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to th CVE-2025-108519.8A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=log CVE-2025-108536.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encod CVE-2025-108548.1The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path CVE-2025-108557.5Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trust CVE-2025-108568.1Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection