CVE-2025-10606

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-10606
A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10606.md Exploit Third Party Advisory
https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60.module.Configuracao.ConfiguracaoMovimentoGeral%60%20parameter%20%60tipoacao%60.md Broken Link
https://vuldb.com/?ctiid.324626 Permissions Required VDB Entry
https://vuldb.com/?id.324626 Third Party Advisory VDB Entry
https://vuldb.com/?submit.649874 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*
History

18 Sep 2025, 20:22

Type Values Removed Values Added
First Time Portabilis
Portabilis i-educar
CPE cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*
References () https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10606.md - () https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10606.md - Exploit, Third Party Advisory
References () https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60.module.Configuracao.ConfiguracaoMovimentoGeral%60%20parameter%20%60tipoacao%60.md - () https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60.module.Configuracao.ConfiguracaoMovimentoGeral%60%20parameter%20%60tipoacao%60.md - Broken Link
References () https://vuldb.com/?ctiid.324626 - () https://vuldb.com/?ctiid.324626 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.324626 - () https://vuldb.com/?id.324626 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.649874 - () https://vuldb.com/?submit.649874 - Third Party Advisory, VDB Entry

17 Sep 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-17 18:15

Updated : 2025-09-18 20:22

NVD link : CVE-2025-10606

Mitre link : CVE-2025-10606

CVE.ORG link : CVE-2025-10606

JSON object : View

Products Affected

portabilis

  • i-educar
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')