CVE-2025-9638

MEDIUM 4.8CVE-2025-9638 · Published 09/12/2025 · updated 14/10/2026

In short

CVE-2025-9638 is a MEDIUM (CVSS 4.8) vulnerability affecting i-educar (portabilis).
Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 12.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
i-educar portabilis	`= 2.10.0`	No fix yet

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matricula_interna parameter in the educar_usuario_cad.php endpoint. This issue affects i-Educar: 2.10.0.

References

fluidattacks.com/advisories/travis · Exploit
portabilis/i-educar · Product

More vulnerabilities in i-educar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

i-educar

portabilis

= 2.10.0

No fix yet

More vulnerabilities in i-educar

See all →