CVE-2025-10011

A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

• CWE-74
• CWE-89
• CWE-74

• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10011.mdExploit, Third Party Advisory
• https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.edit%60%20Endpoint.mdBroken Link
• https://vuldb.com/?ctiid.322736Permissions Required, VDB Entry
• https://vuldb.com/?id.322736Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.643544Third Party Advisory, VDB Entry
• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10011.mdExploit, Third Party Advisory
• https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.edit%60%20Endpoint.mdBroken Link
• https://vuldb.com/?submit.643544Third Party Advisory, VDB Entry

Published

Sep 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10004GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-10006The WPBakery Page Builder plugin for WordPress is vulnerable…5.4
• CVE-2025-10008The Translate WordPress and go Multilingual – Weglot plugin …5.3
• CVE-2025-10009Incorrect handling of uploaded files in the admin "Restore" …8.6
• CVE-2025-1001Medixant RadiAnt DICOM Viewer is vulnerable due to failure o…5.7
• CVE-2025-10010The CPSD CryptoPro Secure Disk application boots a small Lin…6.8
• CVE-2025-10012A security vulnerability has been detected in Portabilis i-E…8.8
• CVE-2025-10013A vulnerability was detected in Portabilis i-Educar up to 2.…6.3
• CVE-2025-10014A flaw has been found in elunez eladmin up to 2.7. This impa…3.1
• CVE-2025-10015The Sparkle framework includes an XPC service Downloader.xpc…4.8
• CVE-2025-10016The Sparkle framework includes a helper tool Autoupdate. Due…8.8
• CVE-2025-10018QuickCMS is vulnerable to multiple Stored XSS in language ed…4.8