CVE-2026-4355

Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting

View on CVE.org
Published Mar 17, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability resides in the file /intranet/educar_servidor_curso_lst.php of Portabilis i‑Educar 2.11. Manipulation of the Name parameter leads to the injection and execution of arbitrary JavaScript within the victim’s browser, enabling attackers to perform actions such as stealing session cookies, defacing content, or conducting phishing attacks. The weakness is identified by CWE‑79 (XSS) and CWE‑94 (Code Injection). The attack may be initiated remotely and the exploit has been publicly disclosed, allowing unprivileged attackers to trigger it via crafted requests.

Affected Systems

Portabilis i‑Educar 2.11 is affected. The CPE identifier for the product is cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Because the exploit can be executed remotely and is publicly available, the likelihood of attack is high; however, the damage is confined to the browser environment of authenticated or unauthenticated users who interact with the affected endpoint. No vendor‑supplied solution or workaround is currently documented, so the risk remains until remediation is applied.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify whether Portabilis has released an update for i‑Educar 2.11 and apply it immediately if available.
  • If no patch exists, restrict or disable access to /intranet/educar_servidor_curso_lst.php or implement input validation to reject JavaScript payloads.
  • Deploy web‑application firewall rules or content‑security‑policy headers that block or sanitize XSS attempts.
  • Continuously monitor web logs for suspicious activity and audit user sessions for signs of XSS exploitation.

Generated by OpenCVE AI on March 18, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting
First Time appeared Portabilis
Portabilis i-educar
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*
Vendors & Products Portabilis
Portabilis i-educar
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 18, 2026, 8:19 PM
Reserved
Mar 17, 2026, 6:32 PM

View source JSON

Updated
Mar 18, 2026, 8:19 PM

JSON

Status
Deferred
Published
Mar 18, 2026, 12:16 AM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Mar 24, 2026, 10:54 AM

JSON