CVE-2025-10074

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10074", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-09-07T11:45:35.532Z", "datePublished": "2025-09-08T00:02:06.034Z", "dateUpdated": "2026-10-20T21:32:30.336Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-20T21:32:30.336Z"}, "title": "Portabilis i-Educar tipos cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "Portabilis", "product": "i-Educar", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1", "status": "affected"}, {"version": "2.2", "status": "affected"}, {"version": "2.3", "status": "affected"}, {"version": "2.4", "status": "affected"}, {"version": "2.5", "status": "affected"}, {"version": "2.6", "status": "affected"}, {"version": "2.7", "status": "affected"}, {"version": "2.8", "status": "affected"}, {"version": "2.9", "status": "affected"}, {"version": "2.10", "status": "affected"}, {"version": "2.12", "status": "unaffected"}], "cpes": ["cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usu\u00e1rio/Descri\u00e7\u00e3o leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.12 is sufficient to fix this issue. The identifier of the patch is 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. It is recommended to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-09-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-09-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-20T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2026-10-20T23:37:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "marceloQz (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "edinei (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "marceloQz (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/vuln/323022", "name": "VDB-323022 | Portabilis i-Educar tipos cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/323022/cti", "name": "VDB-323022 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-10074", "name": "CVE-2025-10074 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/644137", "name": "Submit #644137 | Portabilis i-educar 2.10 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/702974", "name": "Submit #702974 | Portabilis i-Educar 2.10.0 Improper Input Validation (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md", "tags": ["related"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md", "tags": ["exploit"]}, {"url": "https://github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9", "tags": ["patch"]}, {"url": "https://github.com/portabilis/i-educar/tree/2.12", "tags": ["patch"]}, {"url": "https://github.com/portabilis/i-educar/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T17:24:23.662869Z", "id": "CVE-2025-10074", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T17:27:45.755Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10074", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T17:24:23.662869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T17:26:17.340Z"}}], "cna": {"tags": ["x_open-source"], "title": "Portabilis i-Educar tipos cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "marceloQz (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "edinei (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "marceloQz (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*"], "vendor": "Portabilis", "product": "i-Educar", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}, {"status": "unaffected", "version": "2.12"}]}], "timeline": [{"lang": "en", "time": "2025-09-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-09-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-20T00:00:00.000Z", "value": "Countermeasure disclosed"}, {"lang": "en", "time": "2026-10-20T23:37:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/323022", "name": "VDB-323022 | Portabilis i-Educar tipos cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/323022/cti", "name": "VDB-323022 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-10074", "name": "CVE-2025-10074 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/644137", "name": "Submit #644137 | Portabilis i-educar 2.10 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/702974", "name": "Submit #702974 | Portabilis i-Educar 2.10.0 Improper Input Validation (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md", "tags": ["related"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md", "tags": ["exploit"]}, {"url": "https://github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9", "tags": ["patch"]}, {"url": "https://github.com/portabilis/i-educar/tree/2.12", "tags": ["patch"]}, {"url": "https://github.com/portabilis/i-educar/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usu\u00e1rio/Descri\u00e7\u00e3o leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.12 is sufficient to fix this issue. The identifier of the patch is 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. It is recommended to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-20T21:32:30.336Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10074", "state": "PUBLISHED", "dateUpdated": "2026-10-20T21:32:30.336Z", "dateReserved": "2025-09-07T11:45:35.532Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-09-08T00:02:06.034Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*"], "product": "i-Educar", "vendor": "Portabilis", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}, {"status": "unaffected", "version": "2.12"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*", "matchCriteriaId": "877348AB-B600-47B3-A565-8198483C6414", "versionEndIncluding": "2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usu\u00e1rio/Descri\u00e7\u00e3o leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.12 is sufficient to fix this issue. The identifier of the patch is 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en Portabilis i-Educar hasta la versi\u00f3n 2.10 incluida. El elemento afectado es una funci\u00f3n desconocida del archivo /usuarios/tipos/. La manipulaci\u00f3n del argumento Tipos de Usu\u00e1rio/Descri\u00e7\u00e3o conduce a un cross-site scripting. El ataque puede iniciarse de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Actualizar a la versi\u00f3n 2.12 es suficiente para solucionar este problema. El identificador del parche es 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. Se recomienda actualizar el componente afectado."}], "id": "CVE-2025-10074", "lastModified": "2026-11-07T18:10:00.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10074", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-08T17:24:23.662869Z", "version": "2.0.3"}}]}, "published": "2025-09-08T01:15:39.890", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md"}, {"source": "cna@vuldb.com", "tags": ["Broken Link"], "url": "https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/portabilis/i-educar/"}, {"source": "cna@vuldb.com", "url": "https://github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9"}, {"source": "cna@vuldb.com", "url": "https://github.com/portabilis/i-educar/tree/2.12"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2025-10074"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/644137"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/702974"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/323022"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/323022/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-09-08T15:17:29.716500+00:00", "updated": "2025-09-08T15:17:29.716568+00:00", "vendors": ["portabilis", "portabilis$PRODUCT$i-educar"]}