CVE-2025-9687CWE-266CWE-285

CVE-2025-9687

Medium · published August 30, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2025-08-30T16:15Z
Affected products (1)
ProductVersionsFixed in
portabilis/i-educar≤ 2.10—
References (6)
https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20students%20via%20.module.HistoricoEscolar.processamentoApi.md · [email protected]https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9687.md · [email protected]https://vuldb.com/?ctiid.321899 · [email protected]https://vuldb.com/?id.321899 · [email protected]https://vuldb.com/?submit.638582 · [email protected]https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9687.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 12:02Z
    Portabilis i-Educar processamentoApi improper authorization
    cvelistv5