I-Educar on Natan Maia Morette

CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload

Fri, 06 Feb 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2064%20-%20i-Educar%20-%20Stored%20XSS%20via%20Profile%20Picture%20Upload
📋 CVE record: CVE-2026-2064

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	i-Educar - Open-source, web-based school management system widely used by public education institutions in Brazil to manage academic and administrative data in real time.
Affected Version	2.10.0
Endpoint	`/intranet/meusdadod.php`
Vulnerability Type	CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)
CVE ID	CVE-2026-2064

Vulnerability Summary

The /intranet/meusdadod.php endpoint allows authenticated users to upload profile pictures (avatars) without proper file type validation or content sanitization. By exploiting the lack of server-side MIME type verification and file content inspection, an attacker can upload a malicious SVG file containing embedded JavaScript code disguised as a legitimate image file.

CVE-2025-8789: Broken Function Level Authorization (BFLA) allows unauthorized users to alter student grades

Sun, 10 Aug 2025 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8789/
📋 CVE record: CVE-2025-8789

Summary

An API endpoint in i-Educar 2.9.0 is vulnerable to Broken Function Level Authorization (BFLA). An unauthorized user is able to modify student grades by directly accessing the /module/Api/Diario endpoint, bypassing permission controls. This leads to severe integrity issues, where anyone with access to the API format can tamper with academic records.

CVE-2025-8790: Broken Object Level Authorization (BOLA) in pessoa API Endpoint Allows Unauthorized Access to Other Users Data

Sun, 10 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8790/
📋 CVE record: CVE-2025-8790

Summary

A Broken Object Level Authorization (BOLA) vulnerability was identified in the i-educar 2.8 and 2.9 API, allowing any authenticated low-privileged user to access sensitive information from other users by manipulating the id parameter in the pessoa resource endpoint.

CVE-2025-8510: Reflected Cross-Site Scripting (XSS) in educar_matricula_lst.php via ref_cod_aluno Parameter

Sun, 03 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8510%20.md
📋 CVE record: CVE-2025-8510

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the atendidos_cad.php endpoint of the i-educar application 2.10. This vulnerability allows attackers to inject malicious scripts in the ref_cod_alunoparameter.

Details

Vulnerable Endpoint: educar_matricula_lst.php Parameter: ref_cod_aluno

CVE-2025-8346: Cross-Site Scripting (XSS) Reflected endpoint educar_aluno_lst.php via ref_cod_matricula parameter

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8346/
📋 CVE record: CVE-2025-8346

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the educar_aluno_lst.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the ref_cod_matricula parameter.

Details

Vulnerable Endpoint: educar_aluno_lst.php

CVE-2025-8365: Multiples Cross-Site Scripting (XSS) Stored in endpoint atendidos_cad.php

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8365/
📋 CVE record: CVE-2025-8365

Summary

Multiples Stored Cross-Site Scripting (XSS) vulnerabilities was identified in the atendidos_cad.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the nome, nome_social and email parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.