SQL Injection in Portabilis I-educar
CVE-2025-65024
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an auth…
Vulnerability class: SQL Injection
EPSS: 0.000 (14.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Portabilis I-educar — versions <= 2.10.0
Weakness classification (CWE)
References
- https://github.com/portabilis/i-educar/security/advisories/GHSA-6c8p-xqcv-rghx (x_refsource_CONFIRM)
- https://github.com/portabilis/i-educar/commit/3e9763a561b328edaed21a7dc2e0dba0bbbc6e22 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-65024?
- CVE-2025-65024 is a high-severity vulnerability in Portabilis I-educar, classified under SQL Injection. CVSS score: 7.2/10. Published 2025-11-19.
- How severe is CVE-2025-65024?
- High severity. CVSS v3 base score is 7.2 out of 10.