CVE-2025-9532

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Portabilis	i-Educar	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10

References

https://karinagante.github.io/cve-2025-9532/Exploit, Third Party Advisory
https://karinagante.github.io/cve-2025-9532/#proof-of-concept-pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.321551Permissions Required, VDB Entry
https://vuldb.com/?id.321551Third Party Advisory, VDB Entry
https://vuldb.com/?submit.635801Third Party Advisory, VDB Entry
https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/12.mdBroken Link
https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/12.md#pocBroken Link
https://vuldb.com/?submit.635801Third Party Advisory, VDB Entry

Timeline

Published: Aug 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-95339.8A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The m CVE-2025-95398.0The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable t CVE-2025-95404.7The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and CVE-2025-95414.7The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and CVE-2025-95425.4The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable t CVE-2025-95433.5The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow hig CVE-2025-95446.5The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a n CVE-2025-95485.5A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated CVE-2025-95496.5Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.CVE-2025-95506.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Script CVE-2025-95516.5Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Prot CVE-2025-95525.3Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.