CVE-2025-9107

A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79
• CWE-94

• https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9107.mdExploit, Third Party Advisory
• https://github.com/marcelomulder/CVE/blob/main/i-diario/Reflected%20XSS%20endpoint%20search_autocomplete%20parameter%20q.md#pocBroken Link
• https://vuldb.com/?ctiid.320429Permissions Required, VDB Entry
• https://vuldb.com/?id.320429Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.627568Third Party Advisory, VDB Entry
• https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9107.mdExploit, Third Party Advisory
• https://vuldb.com/?submit.627568Third Party Advisory, VDB Entry

Published

Aug 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9101A weakness has been identified in zhenfeng13 My-Blog up to 1…5.4
• CVE-2025-9102A security vulnerability has been detected in 1&1 Mail & Med…5.5
• CVE-2025-9103A vulnerability was detected in ZenCart 2.1.0. Affected by t…2.4
• CVE-2025-9104A flaw has been found in Portabilis i-Diario up to 1.5.0. Th…5.4
• CVE-2025-9105A vulnerability has been found in Portabilis i-Diario up to …5.4
• CVE-2025-9106A vulnerability was found in Portabilis i-Diario up to 1.5.0…5.4
• CVE-2025-9108Affected is an unknown function of the component Login Page.…4.3
• CVE-2025-9109A security flaw has been discovered in Portabilis i-Diario u…3.7
• CVE-2025-9110An exposure of sensitive system information to an unauthoriz…7.5
• CVE-2025-9111The AI ChatBot for WordPress WordPress plugin before 7.1.0 …3.5
• CVE-2025-9112The Doccure theme for WordPress is vulnerable to arbitrary f…8.8
• CVE-2025-9113The Doccure Core plugin for WordPress is vulnerable to arbit…9.8