Description
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuario_cad.php of the component Editar usuário Page. This manipulation of the argument email/data_inicial/data_expiracao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 addresses this issue. Patch name: 5b11c0376fcef7ada4c90760b0ca1ed2f16c4de9. You should upgrade the affected component.
Affected products
portabilis: i-educar
References9
- github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10099.… ExploitThird Party Advisory
- github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Sc… Broken Link
- github.com/portabilis/i-educar/
- github.com/portabilis/i-educar/commit/5b11c0376fcef7ada4c90760b…
- github.com/portabilis/i-educar/tree/2.12
- vuldb.com/cve/CVE-2025-10099
- vuldb.com/submit/644967
- vuldb.com/vuln/323060
- vuldb.com/vuln/323060/cti
Metrics
- CVSS 3.1
-
4.8
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 4.0
-
1.9
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 29 · as of 8 November 2026
- CWE
- CWE-79CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.