CVE-2025-10073CWE-266CWE-285

CVE-2025-10073

Medium · published September 8, 2025

CVSS v3.1

4.3

EPSS

Percentile

28.7

In the wild

Unconfirmed

What it is

A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00361 · 28.7th percentile
Weaknesses: CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published: 2025-09-08T04:15Z

Affected products (1)

Product	Versions	Fixed in
portabilis/i-educar	≤ 2.10.0	—

References (5)

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Api.turma.md · [email protected]https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10073.md · [email protected]https://vuldb.com/?ctiid.323021 · [email protected]https://vuldb.com/?id.323021 · [email protected]https://vuldb.com/?submit.644136 · [email protected]

EPSS history

Timeline

07 SEP 23:32Z
Portabilis i-Educar turma improper authorization
cvelistv5