CVE-2025-7872

Portabilis i-Diario justificativas-de-falta cross site scripting

View on CVE.org
Published Jul 20, 2025 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called 821342cd8d952e8bd214cb16145da785a92f5681. Applying a patch is advised to resolve this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output".

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-21998 A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
History
Type Values Removed Values Added
Description A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called 821342cd8d952e8bd214cb16145da785a92f5681. Applying a patch is advised to resolve this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output".
CPEs cpe:2.3:a:portabilis:i-diario:*:*:*:*:*:*:*:*
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

 cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}
Type Values Removed Values Added
First Time appeared Portabilis
Portabilis i-diario
CPEs cpe:2.3:a:portabilis:i-diario:1.5.0:*:*:*:*:*:*:*
Vendors & Products Portabilis
Portabilis i-diario
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Description A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Portabilis i-Diario justificativas-de-falta cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 9, 2026, 4:42 PM
Reserved
Jul 19, 2025, 5:53 AM

View source JSON

Updated
Jul 22, 2025, 1:50 PM

JSON

Status
Modified
Published
Jul 20, 2025, 7:15 AM
Modified
Oct 9, 2026, 5:16 PM

View source JSON

No data.

No data.