CVE-2025-9687
BaseFortify
Publication date: 2025-08-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| portabilis | i-educar | to 2.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9687 is an improper authorization vulnerability in Portabilis i-Educar versions up to 2.10, specifically in an unknown function within the file /module/HistoricoEscolar/processamentoApi. This flaw occurs due to incorrect or missing authorization checks, allowing unauthorized users to access resources or perform actions they should not be allowed to. The vulnerability can be exploited remotely and has a publicly available proof-of-concept exploit. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by compromising the confidentiality, integrity, and availability of the affected system. Unauthorized actors may gain improper access or perform unauthorized actions remotely, potentially leading to data breaches, manipulation, or disruption of services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network indicators provided for this vulnerability. Detection would likely require monitoring for unauthorized access attempts to the /module/HistoricoEscolar/processamentoApi endpoint or unusual privilege escalations related to Portabilis i-Educar versions up to 2.10. Since a public proof-of-concept exploit exists, monitoring for exploit attempts targeting this API endpoint is recommended. However, no explicit detection commands or signatures are available. [1]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been identified for this vulnerability. The suggested immediate step is to replace the affected component or product with an alternative that is not vulnerable. Additionally, monitoring and restricting access to the /module/HistoricoEscolar/processamentoApi endpoint and applying strict authorization controls may help reduce risk until a fix is available. [1]