Portabilis vulnerabilities
We track 30 vulnerabilities in Portabilis products. 30 are rated high or critical, and none are known to be exploited. The most recent was published on February 6, 2026.
Latest Portabilis vulnerabilities
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorizati
- 7.2 High severity
i-educar: Improper Neutralization of Special Elements used in an SQL Command
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can
- 7.2 High severity
i-educar: Improper Neutralization of Special Elements used in an SQL Command
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated sess
- 7.2 High severity
i-educar: Improper Neutralization of Special Elements used in an SQL Command
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute a
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecu
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been published and may be use
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The ex
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /consulta-dispensas. Such manipulation leads to improper authorization. The attack may be launched remotely. Th
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /module/Api/aluno. This manipulation of the argument aluno_id causes improper authorization. The attack may be initiated remotely. The exploit has bee
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotel
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been mad
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The ex
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be ex
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possibl
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remo
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote locati
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation of the argument ID resu
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/AreaConhecimento/view of the component Listagem de áreas de conhecimento Page. Such manipulation of the argument ID leads to sql injec
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitati
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitat
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to s
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument cod_agenda results in sql injection. It is possible to i
- 8.8 High severity
i-Educar: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql inject
- 8.1 High severity
i-educar: Improper Neutralization of Special Elements used in an SQL Command
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is n
- 8.8 High severity
i-educar: Improper Neutralization of Special Elements used in an SQL Command
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` f
- 8.1 High severity
i-educar: Missing Authorization
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change the