CVE-2025-11554

HighCVSS 8.8/10Last modified Oct 20, 2026

Description

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 can resolve this issue. The identifier of the patch is d53365e5656f6499a4deddf89d522814655f769d. It is advisable to upgrade the affected component.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-277

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2025
Last modified: Oct 20, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-115559.8A vulnerability was detected in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/calendar_of CVE-2025-115569.8A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipul CVE-2025-115579.8A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add CVE-2025-115589.8A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php.CVE-2025-11567.3A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file CVE-2025-115607.1The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, lead CVE-2025-115618.8A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configur CVE-2025-115634.6URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without th CVE-2025-115645.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin CVE-2025-115657.3CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system CVE-2025-115666.9CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to CVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is n