CVE-2025-9760

A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

• CWE-266
• CWE-285

• https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Function%20Level%20Authorization%20on%20%60matricula%60%20API%20allows%20deletion%20of%20%E2%80%9Cabandono%E2%80%9D%20status.md#proof-of-concept-pocBroken Link
• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9760.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.322061Permissions Required, VDB Entry
• https://vuldb.com/?id.322061Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.640690Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.643575Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.648827Third Party Advisory, VDB Entry
• https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9760.mdExploit, Third Party Advisory

Published

Sep 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9754A flaw has been found in Campcodes Online Hospital Managemen…5.4
• CVE-2025-9755A vulnerability has been found in Khanakag-17 Library Manage…6.1
• CVE-2025-9756A vulnerability was found in PHPGurukul User Management Syst…8.8
• CVE-2025-9757A vulnerability was determined in Campcodes/SourceCodester C…9.8
• CVE-2025-9758A vulnerability was identified in deepakmisal24 Chemical Inv…9.8
• CVE-2025-9759A security flaw has been discovered in Campcodes/SourceCodes…9.8
• CVE-2025-9761A security vulnerability has been detected in Campcodes Onli…9.8
• CVE-2025-9762The Post By Email plugin for WordPress is vulnerable to arbi…9.8
• CVE-2025-9763A vulnerability was detected in Campcodes Online Learning Ma…9.8
• CVE-2025-9764A flaw has been found in itsourcecode Sports Management Syst…9.8
• CVE-2025-9765A vulnerability has been found in itsourcecode Sports Manage…9.8
• CVE-2025-9766A vulnerability was found in itsourcecode Sports Management …9.8