CVE-2025-10012

Katalog CVE

CVSS 8.8 · High EPSS 0,38%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada portabilis i-educar. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".

Rincian

Terbit di NVD

5 September 2025

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10012.md exploit · advisory pihak ketiga
• https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability... broken link
• https://github.com/portabilis/i-educar/tree/2.12
• https://vuldb.com/cve/CVE-2025-10012
• https://vuldb.com/submit/643549
• https://vuldb.com/vuln/322737
• https://vuldb.com/vuln/322737/cti