CVE-2025-10846

MEDIUM

Portabilis I-educar < 2.10.0 - Injection

Title source: rule

Description

A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Exploits (1)

github WRITEUP
by KarinaGante · htmlpoc
https://github.com/KarinaGante/KG-Sec/tree/main/CVEs/i-Educar/CVE-2025-10846.md

References (5)

Scores

CVSS v3 6.3
EPSS 0.0003
EPSS Percentile 6.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-74 CWE-89
Status published

Affected Products (1)

portabilis/i-educar < 2.10.0

Timeline

Published Sep 23, 2025
Tracked Since Feb 18, 2026