XSS on Natan Maia Morette

CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload

Fri, 06 Feb 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2064%20-%20i-Educar%20-%20Stored%20XSS%20via%20Profile%20Picture%20Upload
📋 CVE record: CVE-2026-2064

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	i-Educar - Open-source, web-based school management system widely used by public education institutions in Brazil to manage academic and administrative data in real time.
Affected Version	2.10.0
Endpoint	`/intranet/meusdadod.php`
Vulnerability Type	CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)
CVE ID	CVE-2026-2064

Vulnerability Summary

The /intranet/meusdadod.php endpoint allows authenticated users to upload profile pictures (avatars) without proper file type validation or content sanitization. By exploiting the lack of server-side MIME type verification and file content inspection, an attacker can upload a malicious SVG file containing embedded JavaScript code disguised as a legitimate image file.

CVE-2025-9823: Reflected XSS in lead:addLeadTags - Quick Add

Wed, 03 Sep 2025 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-9823/
📋 CVE record: CVE-2025-9823

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-9823

Vendor

Mautic is an open-source marketing automation platform used worldwide.

https://mautic.org/

Affected Product Code Base

Affected versions:

= 4.4.0, < 4.4.17 = 5.0.0-alpha, < 5.2.8 = 6.0.0-alpha, < 6.0.5 Patched versions: 4.4.17, 5.2.8, 6.0.5

CVE-2025-9404: Storage Cross-Site Scripting (XSS) in endpoint pointHIerarchySLTS parameter title

Mon, 25 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md
📋 CVE record: CVE-2025-9404

Summary

Stored Cross-Site Scripting (XSS) vulnerability was identified in the pointHIerarchySLTS endpoint. This vulnerability allows attackers to inject malicious scripts into the username parameter. The injected scripts are stored on the server and executed automatically whenever the page pointHIerarchySLTS is accessed by users, posing a significant security risk.

CVE-2025-8510: Reflected Cross-Site Scripting (XSS) in educar_matricula_lst.php via ref_cod_aluno Parameter

Sun, 03 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8510%20.md
📋 CVE record: CVE-2025-8510

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the atendidos_cad.php endpoint of the i-educar application 2.10. This vulnerability allows attackers to inject malicious scripts in the ref_cod_alunoparameter.

Details

Vulnerable Endpoint: educar_matricula_lst.php Parameter: ref_cod_aluno

CVE-2025-8346: Cross-Site Scripting (XSS) Reflected endpoint educar_aluno_lst.php via ref_cod_matricula parameter

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8346/
📋 CVE record: CVE-2025-8346

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the educar_aluno_lst.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the ref_cod_matricula parameter.

Details

Vulnerable Endpoint: educar_aluno_lst.php

CVE-2025-8365: Multiples Cross-Site Scripting (XSS) Stored in endpoint atendidos_cad.php

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8365/
📋 CVE record: CVE-2025-8365

Summary

Multiples Stored Cross-Site Scripting (XSS) vulnerabilities was identified in the atendidos_cad.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the nome, nome_social and email parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-7870: Cross-Site Scripting (XSS) Storage Injection via SVG Upload

Sun, 20 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7870/
📋 CVE record: CVE-2025-7870

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7870

Summary

An attacker can upload a malicious SVG file containing embedded JavaScript that is executed when the file is accessed directly. This results in Stored Cross-Site Scripting (XSS).

CVE-2025-7871: Cross-Site Scripting (XSS) Reflected endpoint conteudos parameter filter[by_description]

Sun, 20 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7871/
📋 CVE record: CVE-2025-7871

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7871

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the conteudos endpoint of the i-Diário application. This vulnerability allows attackers to inject malicious scripts into the filter[by_description] parameter.

CVE-2025-7728: Cross-Site Scripting (XSS) Stored endpoint users.shtm parameter username

Thu, 17 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7728/
📋 CVE record: CVE-2025-7728

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7728

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the users.shtm endpoint of the Scada-LTS application. This vulnerability allows attackers to inject malicious scripts into the usernameparameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-7729: Cross-Site Scripting (XSS) Stored endpoint usersProfiles.shtm parameter userprofilename

Thu, 17 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7729/
📋 CVE record: CVE-2025-7729

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7729

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the usersProfiles.shtm endpoint of the Scada-LTS application. This vulnerability allows attackers to inject malicious scripts into the userprofilenameparameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-30366: Multiples Stored XSS in personalizacao.php

Thu, 27 Mar 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-30366/
📋 CVE record: CVE-2025-30366

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-30366

Summary

Multiples stored Cross-Site Scripting (XSS) vulnerability was identified in the WeGIA application. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page.

CVE-2024-57030: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter id

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57030/
📋 CVE record: CVE-2024-57030

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57030

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57033: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter dados_addInfo

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57033/
📋 CVE record: CVE-2024-57033

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57033

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2025-22599: Cross-Site Scripting (XSS) Reflected endpoint home.php parameter msg_c

Fri, 10 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22599/
📋 CVE record: CVE-2025-22599

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22599

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter.

CVE-2025-22600: Cross-Site Scripting (XSS) Reflected endpoint configuracao_doacao.php parameter avulso

Fri, 10 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22600/
📋 CVE record: CVE-2025-22600

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22600

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter.

CVE-2025-22139: Cross-Site Scripting (XSS) Reflected endpoint configuracao_geral.php parameter msg

Wed, 08 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22139/
📋 CVE record: CVE-2025-22139

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22139

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter.

CVE-2025-22132: Cross-Site Scripting (XSS) in File Upload Field

Tue, 07 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22132/
📋 CVE record: CVE-2025-22132

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22132

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53470: Stored XSS in gateway_pagamento.php function

Thu, 05 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53470/
📋 CVE record: CVE-2024-53470

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53470

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53471: Stored XSS in meio_pagamento.php function

Thu, 05 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53471/
📋 CVE record: CVE-2024-53471

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53471

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544