CVE-2025-11048

HighCVSS 8.8/10Last modified Oct 9, 2026

Description

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
Portabilis	i-Educar	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10

References

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%20in%20%60.consulta-dispensas%60%20Endpoint.mdBroken Link
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11048.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.326085Permissions Required, VDB Entry
https://vuldb.com/?id.326085Third Party Advisory, VDB Entry
https://vuldb.com/?submit.659202Third Party Advisory, VDB Entry
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-11048.mdExploit, Third Party Advisory
https://vuldb.com/?submit.659202Third Party Advisory, VDB Entry

Timeline

Published: Sep 26, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-110498.8A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao CVE-2025-11056.1A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of t CVE-2025-110508.8A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulatio CVE-2025-110516.5A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code. The manipula CVE-2025-110529.8A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Prof CVE-2025-110539.8A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing man CVE-2025-110548.8A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobport CVE-2025-110559.8A vulnerability was detected in SourceCodester Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/updat CVE-2025-110569.8A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2025-110579.8A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality CVE-2025-11066.5A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the l CVE-2025-110605.7A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe