CVE-2025-8539

LOW

Portabilis i-Educar 2.10 - Cross-Site Scripting via nome Parameter in /intranet/public_distrito_cad.php

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-8539. PoCs published by KarinaGante.

AI-analyzed exploit summary The repository contains a detailed writeup for CVE-2025-8539, focusing on a directory traversal vulnerability in a web application. It includes technical details, screenshots, and step-by-step exploitation instructions, demonstrating the vulnerability's impact and root cause.

Description

A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

github WRITEUP

by KarinaGante · htmlpoc

https://github.com/KarinaGante/KG-Sec/tree/main/CVEs/i-Educar/CVE-2025-8539.md

View Code ZIP pw:eip

The repository contains a detailed writeup for CVE-2025-8539, focusing on a directory traversal vulnerability in a web application. It includes technical details, screenshots, and step-by-step exploitation instructions, demonstrating the vulnerability's impact and root cause.

Classification

Writeup 95%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Unknown (likely a web application with directory traversal vulnerability)

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK

T1005 - Data from Local System T1552 - Unsecured Credentials

devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.318668

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.318668

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.620453

Exploit, Third Party Advisory exploit

https://karinagante.github.io/cve-2025-8539/

Exploit, Third Party Advisory

https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/CVE-2025-8539.md

Scores

CVSS v3 2.4

EPSS 0.0028

EPSS Percentile 19.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

portabilis/i-educar 2.10.0

Published Aug 05, 2025

Tracked Since Feb 18, 2026