CVE-2025-8786
BaseFortify
Publication date: 2025-08-10
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| portabilis | i-diario | to 1.5.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8786 is a Stored Cross-Site Scripting (XSS) vulnerability in Portabilis i-Diario up to version 1.5.0. It occurs in the endpoint /registros-de-conteudos-por-areas-de-conhecimento/ within the component Registro das atividades. The vulnerability arises because the application does not properly validate or sanitize user inputs in parameters like "Registro de atividades" and "Conteúdos." This allows attackers to inject malicious scripts that are stored on the server and executed in the browsers of users who visit the affected pages, potentially leading to various security risks. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to several impacts including theft of session cookies enabling session hijacking, installation of malware on victim systems, browser hijacking, theft of user credentials, unauthorized access to sensitive information, website defacement, misdirection of users by altering website content, and damage to business reputation through misinformation or defacement. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the affected endpoint `/registros-de-conteudos-por-areas-de-conhecimento/[ID]` for stored cross-site scripting (XSS) by injecting typical XSS payloads such as `<script>alert('PoC-XXS2')</script>` into parameters like "Registro de atividades" or "Conteúdos" and then accessing the page to see if the script executes. Detection can be performed using web application security testing tools or manual curl commands to submit payloads and observe responses. For example, a curl command to test injection might be: curl -X POST -d "Registro de atividades=<script>alert('PoC-XXS2')</script>" https://target-domain/registros-de-conteudos-por-areas-de-conhecimento/[ID] Followed by accessing the affected page in a browser to check for script execution. Additionally, monitoring web server logs for suspicious input patterns or unexpected script tags in stored content can help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding use of the affected Portabilis i-Diario version up to 1.5.0, as no vendor patch or official mitigation is available. Consider replacing the affected product or disabling the vulnerable component if possible. Implement web application firewall (WAF) rules to block or sanitize suspicious input containing script tags or typical XSS payloads targeting the affected endpoint. Educate users to be cautious about interacting with untrusted content from the affected application. Monitor for exploitation attempts and apply general XSS protections such as Content Security Policy (CSP) headers to reduce impact. Since the vendor has not responded and no patches exist, these defensive measures are critical. [2]