CVE-2025-9686HIGH 8.8EPSS p26.8%
CVE-2025-9686CVE-2025-9686
Description
A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Scoring
| CVSS 3.1 | 8.8 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.35% probability of exploitation · percentile 26.8% · 2026-06-19T12:03:05Z |
| Published | 2025-08-30 |
| Last modified | 2026-04-29 |
Underlying weaknesses· 2
References
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9686.md
- https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.AreaConhecimento.edit%60%20Endpoint.md
- https://vuldb.com/?ctiid.321898
- https://vuldb.com/?id.321898
- https://vuldb.com/?submit.638577
- https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9686.md
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')cwe-74 | 0% | live |
| Weakness | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')cwe-89 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.