CVE-2025-10608CWE-266CWE-284broken-access-control

CVE-2025-10608

Medium · published September 17, 2025

CVSS v3.1

6.3

EPSS

Percentile

31.5

In the wild

Unconfirmed

What it is

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00387 · 31.5th percentile
Weaknesses: CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published: 2025-09-17T23:15Z

Affected products (1)

Product	Versions	Fixed in
portabilis/i-educar	≤ 2.10.0	—

References (7)

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.enrollment-history.(ID)%60%20Endpoint.md · [email protected]https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10608.md · [email protected]https://vuldb.com/?ctiid.324628 · [email protected]https://vuldb.com/?id.324628 · [email protected]https://vuldb.com/?submit.649876 · [email protected]https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10608.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0 https://vuldb.com/?submit.649876 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 SEP 18:32Z
Portabilis i-Educar enrollment-history access control
cvelistv5