The vulnerability is located in Portabilis i‑Educar up to version 2.10, inside the file /intranet/meusdadod.php. By carefully crafting the value of the parameter named File, an attacker can send arbitrary script payloads that are rendered unescaped. The reflected XSS allows the execution of attacker‑supplied JavaScript in the victim’s browser, potentially leading to session hijacking, credential theft or defacement, depending on the attacker’s goal.

Portabilis i‑Educar versions up to and including 2.10, particularly the User Data Page component that processes the File argument. The flaw is reachable through the public intranet interface and is likely deployed in educational institutions that rely on the application for internal user management.

The CVSS score of 5.1 classifies it as moderate severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation at present. It is not listed in the CISA KEV catalog, so there is no evidence of widespread active attacks yet. Nevertheless, the flaw is exploitable remotely via the internet, and attackers can trigger it by embedding a malicious payload in the File parameter of the exposed URL. Without an official vendor patch, the risk remains until a suitable mitigations are applied or the product is upgraded beyond the affected release.