A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-10074
• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md
• https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md
• https://vuldb.com/?ctiid.323022
• https://vuldb.com/?id.323022
• https://vuldb.com/?submit.644137