CVE-2024-55651: i-Educar Stored Cross-Site Scripting vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-08 · updated 2026-06-17
Weakness: CWE-79

Description

i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.

Affected products

Portabilis i-Educar: 2.9.0

References

https://github.com/portabilis/i-educar/security/advisories/GHSA-8fjj-9937-g84w

Get alerted when CVE-2024-55651 or the next vulnerability affects your stack