https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2064.htmlhttps://patchthecve.com/cve/CVE-2026-2064.htmlWed, 17 Jun 2026 10:30:13 +0000LOW 3.5: A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/meusdadod.php of the component User Data Page. Such manipulation of the argument File leads to cross site scripting. It is possible to launch the attack https://patchthecve.com/cve/CVE-2026-2015.htmlhttps://patchthecve.com/cve/CVE-2026-2015.htmlTue, 15 Sep 2026 03:17:05 +0000MEDIUM 6.3: A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorization. The attack can be executed remotely.https://patchthecve.com/cve/CVE-2025-9638.htmlhttps://patchthecve.com/cve/CVE-2025-9638.htmlWed, 14 Oct 2026 21:10:00 +0000MEDIUM 4.8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.https://patchthecve.com/cve/CVE-2025-65024.htmlhttps://patchthecve.com/cve/CVE-2025-65024.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.2: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against https://patchthecve.com/cve/CVE-2025-65023.htmlhttps://patchthecve.com/cve/CVE-2025-65023.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.2: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands ahttps://patchthecve.com/cve/CVE-2025-65022.htmlhttps://patchthecve.com/cve/CVE-2025-65022.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.2: i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the applichttps://patchthecve.com/cve/CVE-2025-11554.htmlhttps://patchthecve.com/cve/CVE-2025-11554.htmlTue, 20 Oct 2026 22:17:42 +0000MEDIUM 6.3: A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack mayhttps://patchthecve.com/cve/CVE-2025-11050.htmlhttps://patchthecve.com/cve/CVE-2025-11050.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.3: A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been published and may be used.https://patchthecve.com/cve/CVE-2025-11049.htmlhttps://patchthecve.com/cve/CVE-2025-11049.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.3: A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit is now public and may be used.https://patchthecve.com/cve/CVE-2025-11048.htmlhttps://patchthecve.com/cve/CVE-2025-11048.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.3: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly anhttps://patchthecve.com/cve/CVE-2025-11047.htmlhttps://patchthecve.com/cve/CVE-2025-11047.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.3: A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and couldhttps://patchthecve.com/cve/CVE-2025-10846.htmlhttps://patchthecve.com/cve/CVE-2025-10846.htmlSun, 11 Oct 2026 20:10:00 +0000MEDIUM 6.3: A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly discloshttps://patchthecve.com/cve/CVE-2025-10845.htmlhttps://patchthecve.com/cve/CVE-2025-10845.htmlSun, 11 Oct 2026 20:10:00 +0000MEDIUM 6.3: A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.https://patchthecve.com/cve/CVE-2025-10844.htmlhttps://patchthecve.com/cve/CVE-2025-10844.htmlSun, 11 Oct 2026 20:10:00 +0000MEDIUM 6.3: A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the https://patchthecve.com/cve/CVE-2025-10373.htmlhttps://patchthecve.com/cve/CVE-2025-10373.htmlWed, 17 Jun 2026 08:28:11 +0000LOW 3.5: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_tipo_cad.php. Such manipulation of the argument nm_tipo leads to cross site scripting. It is possible to launch the attack remotely. The exploihttps://patchthecve.com/cve/CVE-2025-10372.htmlhttps://patchthecve.com/cve/CVE-2025-10372.htmlWed, 17 Jun 2026 08:28:11 +0000LOW 3.5: A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulation of the argument nm_tipo/descricao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made avhttps://patchthecve.com/cve/CVE-2025-10099.htmlhttps://patchthecve.com/cve/CVE-2025-10099.htmlTue, 20 Oct 2026 22:17:42 +0000LOW 2.4: A weakness has been identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_usuario_cad.php of the component Editar usuário Page. This manipulation of the argument email/data_inicial/data_expiracao causes cross site scripthttps://patchthecve.com/cve/CVE-2025-10074.htmlhttps://patchthecve.com/cve/CVE-2025-10074.htmlTue, 20 Oct 2026 22:17:42 +0000LOW 3.5: A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly availabhttps://patchthecve.com/cve/CVE-2025-10073.htmlhttps://patchthecve.com/cve/CVE-2025-10073.htmlWed, 30 Sep 2026 23:10:00 +0000MEDIUM 4.3: A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.https://patchthecve.com/cve/CVE-2025-10072.htmlhttps://patchthecve.com/cve/CVE-2025-10072.htmlFri, 18 Sep 2026 09:16:37 +0000MEDIUM 6.3: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and chttps://patchthecve.com/cve/CVE-2025-10071.htmlhttps://patchthecve.com/cve/CVE-2025-10071.htmlTue, 20 Oct 2026 22:17:41 +0000MEDIUM 6.3: A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be uhttps://patchthecve.com/cve/CVE-2025-10070.htmlhttps://patchthecve.com/cve/CVE-2025-10070.htmlTue, 20 Oct 2026 22:17:41 +0000MEDIUM 6.3: A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 2.12 is ahttps://patchthecve.com/cve/CVE-2025-10013.htmlhttps://patchthecve.com/cve/CVE-2025-10013.htmlTue, 20 Oct 2026 22:17:40 +0000MEDIUM 6.3: A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading https://patchthecve.com/cve/CVE-2025-10012.htmlhttps://patchthecve.com/cve/CVE-2025-10012.htmlTue, 15 Sep 2026 09:16:43 +0000MEDIUM 6.3: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been dihttps://patchthecve.com/cve/CVE-2025-10011.htmlhttps://patchthecve.com/cve/CVE-2025-10011.htmlWed, 17 Jun 2026 08:27:30 +0000MEDIUM 6.3: A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available thttps://patchthecve.com/cve/CVE-2025-9760.htmlhttps://patchthecve.com/cve/CVE-2025-9760.htmlWed, 17 Jun 2026 10:09:42 +0000MEDIUM 6.3: A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made availablhttps://patchthecve.com/cve/CVE-2025-9738.htmlhttps://patchthecve.com/cve/CVE-2025-9738.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_tipo_ensino_cad.php. Executing manipulation of the argument nm_tipo can lead to cross site scripting. The attack can be executed remotely. The exploit has https://patchthecve.com/cve/CVE-2025-9724.htmlhttps://patchthecve.com/cve/CVE-2025-9724.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino_cad.php. Executing manipulation of the argument nm_nivel/descricao can lead to cross site scripting. The attack can be launched remotely. The exploit has been https://patchthecve.com/cve/CVE-2025-9723.htmlhttps://patchthecve.com/cve/CVE-2025-9723.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.php. Performing manipulation of the argument nm_tipo results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and https://patchthecve.com/cve/CVE-2025-9722.htmlhttps://patchthecve.com/cve/CVE-2025-9722.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_tipo_ocorrencia_disciplinar_cad.php. Such manipulation of the argument nm_tipo/descricao leads to cross site scripting. It is possible to launch the attack remothttps://patchthecve.com/cve/CVE-2025-9721.htmlhttps://patchthecve.com/cve/CVE-2025-9721.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. This manipulation of the argument nome/formulaMedia causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published https://patchthecve.com/cve/CVE-2025-9720.htmlhttps://patchthecve.com/cve/CVE-2025-9720.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performed fhttps://patchthecve.com/cve/CVE-2025-9687.htmlhttps://patchthecve.com/cve/CVE-2025-9687.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote location. The exploit has been made available https://patchthecve.com/cve/CVE-2025-9686.htmlhttps://patchthecve.com/cve/CVE-2025-9686.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation of the argument ID results in sql injection. The attack is posshttps://patchthecve.com/cve/CVE-2025-9685.htmlhttps://patchthecve.com/cve/CVE-2025-9685.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/AreaConhecimento/view of the component Listagem de áreas de conhecimento Page. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotelhttps://patchthecve.com/cve/CVE-2025-9684.htmlhttps://patchthecve.com/cve/CVE-2025-9684.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploihttps://patchthecve.com/cve/CVE-2025-9653.htmlhttps://patchthecve.com/cve/CVE-2025-9653.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_projeto_cad.php of the component Cadastrar projeto Page. Such manipulation of the argument nome/observacao leads to cross site scripting. It is pohttps://patchthecve.com/cve/CVE-2025-9652.htmlhttps://patchthecve.com/cve/CVE-2025-9652.htmlSun, 18 Oct 2026 21:10:00 +0000LOW 3.5: A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is posshttps://patchthecve.com/cve/CVE-2025-9609.htmlhttps://patchthecve.com/cve/CVE-2025-9609.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.https://patchthecve.com/cve/CVE-2025-9608.htmlhttps://patchthecve.com/cve/CVE-2025-9608.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The explohttps://patchthecve.com/cve/CVE-2025-9607.htmlhttps://patchthecve.com/cve/CVE-2025-9607.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The attack may be launchedhttps://patchthecve.com/cve/CVE-2025-9606.htmlhttps://patchthecve.com/cve/CVE-2025-9606.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.3: A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit ihttps://patchthecve.com/cve/CVE-2025-9532.htmlhttps://patchthecve.com/cve/CVE-2025-9532.htmlWed, 17 Jun 2026 10:09:11 +0000MEDIUM 6.3: A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor wahttps://patchthecve.com/cve/CVE-2025-9531.htmlhttps://patchthecve.com/cve/CVE-2025-9531.htmlTue, 15 Sep 2026 14:16:45 +0000MEDIUM 6.3: A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploithttps://patchthecve.com/cve/CVE-2025-9236.htmlhttps://patchthecve.com/cve/CVE-2025-9236.htmlTue, 15 Sep 2026 16:17:07 +0000MEDIUM 6.3: A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. The attack may be performed from rehttps://patchthecve.com/cve/CVE-2025-8920.htmlhttps://patchthecve.com/cve/CVE-2025-8920.htmlWed, 17 Jun 2026 10:07:55 +0000LOW 2.4: A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of the component Dicionário de Termos BNCC Page. The manipulation of the argument Planos de ensino leads to cross site scripting. The attack cahttps://patchthecve.com/cve/CVE-2025-8919.htmlhttps://patchthecve.com/cve/CVE-2025-8919.htmlWed, 17 Jun 2026 10:07:55 +0000LOW 2.4: A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch thehttps://patchthecve.com/cve/CVE-2025-8918.htmlhttps://patchthecve.com/cve/CVE-2025-8918.htmlWed, 17 Jun 2026 10:07:54 +0000LOW 2.4: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads to cross site scripting. The attack may be initiated remotelhttps://patchthecve.com/cve/CVE-2025-8790.htmlhttps://patchthecve.com/cve/CVE-2025-8790.htmlWed, 17 Jun 2026 10:07:38 +0000MEDIUM 4.3: A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been declared as critical. This vulnerability affects unknown code of the file /module/Api/pessoa of the component API Endpoint. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remothttps://patchthecve.com/cve/CVE-2025-8789.htmlhttps://patchthecve.com/cve/CVE-2025-8789.htmlWed, 17 Jun 2026 10:07:37 +0000MEDIUM 4.3: A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diario of the component API Endpoint. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit