CVE-2025-9531

MEDIUM

Portabilis i-Educar <2.10 - SQL Injection

Title source: llm

Description

A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

github WRITEUP
by KarinaGante · htmlpoc
https://github.com/KarinaGante/KG-Sec/tree/main/CVEs/i-Educar/CVE-2025-9531.md

References (5)

Scores

CVSS v3 6.3
EPSS 0.0003
EPSS Percentile 6.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-74 CWE-89
Status published

Affected Products (1)

portabilis/i-educar < 2.10

Timeline

Published Aug 27, 2025
Tracked Since Feb 18, 2026