CVE-2025-10074: Portabilis i-Educar XSS Vulnerability

CVE-2025-10074 Overview

CVE-2025-10074 is a stored cross-site scripting (XSS) vulnerability affecting Portabilis i-Educar through version 2.10. The flaw resides in the /usuarios/tipos/ endpoint, where the Tipos de Usuário and Descrição parameters accept unsanitized user input. An authenticated remote attacker with low privileges can inject persistent script payloads that execute in the browser of any user viewing the affected user-type records. Public disclosure of the issue has occurred, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Persistent script payloads stored in the user-type management interface execute against administrators, enabling session theft, forced actions, and potential lateral escalation within the i-Educar application.

Affected Products

Portabilis i-Educar versions up to and including 2.10
Deployments exposing the /usuarios/tipos/ administrative interface
Any i-Educar instance where low-privilege accounts can create or edit user types

Discovery Timeline

2025-09-08 - CVE-2025-10074 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10074

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the user-type management module of Portabilis i-Educar. When an authenticated user submits data through the /usuarios/tipos/ endpoint, the application persists the Tipos de Usuário and Descrição field values without adequate output encoding. When the stored values are later rendered in the administrative interface, the browser interprets injected HTML and JavaScript as executable content.

Because the payload is persistent, every session that loads the affected view triggers execution. Attackers can weaponize this behavior to hijack authenticated sessions, exfiltrate CSRF tokens, or perform privileged actions on behalf of administrators who visit the compromised record.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled string fields associated with user-type definitions. The application trusts the values written to the database and reflects them back into HTML contexts without escaping angle brackets, quotes, or event-handler attributes. This maps directly to CWE-79.

Attack Vector

Exploitation requires network access to the i-Educar web application and a valid low-privilege account permitted to interact with user-type records. The attacker submits a crafted value in the Tipos de Usuário or Descrição parameter containing script content. When a higher-privileged user, such as an administrator, later navigates to the affected page, the payload executes in that user's browser session. Additional detail is available in the GitHub XSS vulnerability report and the VulDB #323022 analysis.

Detection Methods for CVE-2025-10074

Indicators of Compromise

Presence of <script>, onerror=, onload=, or javascript: substrings within stored Tipos de Usuário or Descrição field values.
Unexpected outbound HTTP requests from administrator browsers immediately after opening the user-type management page.
Session cookies for privileged i-Educar accounts appearing in unfamiliar source addresses shortly after user-type records are viewed.

Detection Strategies

Query the i-Educar database for user-type records containing HTML tag characters or JavaScript event handlers in the two vulnerable fields.
Inspect web server access logs for POST requests to /usuarios/tipos/ that carry payload lengths inconsistent with legitimate administrative use.
Enable browser-side Content Security Policy reporting to surface script executions originating from stored content.

Monitoring Recommendations

Alert on modifications to /usuarios/tipos/ performed by non-administrative accounts.
Correlate user-type edits with subsequent session anomalies for accounts that viewed the same record.
Retain HTTP request bodies for administrative endpoints to support post-incident forensic review.

How to Mitigate CVE-2025-10074

Immediate Actions Required

Restrict access to the /usuarios/tipos/ endpoint to trusted administrative accounts until a fixed release is deployed.
Audit existing user-type records and remove any values containing HTML or JavaScript payloads.
Rotate session tokens and credentials for privileged accounts that may have viewed tampered records.

Patch Information

No vendor patch reference is listed in the enriched CVE data at time of writing. Monitor the Portabilis i-Educar project and the VulDB entry for CVE-2025-10074 for updates, and upgrade beyond version 2.10 once a corrected release is published.

Workarounds

Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in POST bodies targeting /usuarios/tipos/.
Enforce a strict Content Security Policy that disallows inline scripts within the i-Educar administrative interface.
Reduce the number of accounts permitted to create or edit user-type records to the minimum operationally required.

bash

# Example nginx rule to block obvious XSS payloads on the affected endpoint
location /usuarios/tipos/ {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://i_educar_backend;
}