CVE-2025-9638

MEDIUM

Portabilis i-Educar 2.10.0 - Stored Cross-Site Scripting via matricula_interna Parameter

Title source: llm

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.

References (2)

Core 2

Core References

Exploit, Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/travis

Product product

https://github.com/portabilis/i-educar

Scores

CVSS v3 4.8

EPSS 0.0018

EPSS Percentile 7.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

portabilis/i-educar 2.10.0

Published Dec 09, 2025

Tracked Since Feb 18, 2026