Description
A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-17
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the file /intranet/educar_servidor_curso_lst.php of Portabilis i‑Educar 2.11. Manipulation of the Name parameter leads to the injection and execution of arbitrary JavaScript within the victim’s browser, enabling attackers to perform actions such as stealing session cookies, defacing content, or conducting phishing attacks. The weakness is identified by CWE‑79 (XSS) and CWE‑94 (Code Injection). The attack may be initiated remotely and the exploit has been publicly disclosed, allowing unprivileged attackers to trigger it via crafted requests.

Affected Systems

Portabilis i‑Educar 2.11 is affected. The CPE identifier for the product is cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Because the exploit can be executed remotely and is publicly available, the likelihood of attack is high; however, the damage is confined to the browser environment of authenticated or unauthenticated users who interact with the affected endpoint. No vendor‑supplied solution or workaround is currently documented, so the risk remains until remediation is applied.

Generated by OpenCVE AI on March 18, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether Portabilis has released an update for i‑Educar 2.11 and apply it immediately if available.
  • If no patch exists, restrict or disable access to /intranet/educar_servidor_curso_lst.php or implement input validation to reject JavaScript payloads.
  • Deploy web‑application firewall rules or content‑security‑policy headers that block or sanitize XSS attempts.
  • Continuously monitor web logs for suspicious activity and audit user sessions for signs of XSS exploitation.

Generated by OpenCVE AI on March 18, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 18 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 17 Mar 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting
First Time appeared Portabilis
Portabilis i-educar
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:portabilis:i-educar:*:*:*:*:*:*:*:*
Vendors & Products Portabilis
Portabilis i-educar
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Portabilis I-educar
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-18T20:19:52.541Z

Reserved: 2026-03-17T18:32:46.571Z

Link: CVE-2026-4355

cve-icon Vulnrichment

Updated: 2026-03-18T20:19:49.813Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-18T00:16:20.683

Modified: 2026-03-18T14:52:44.227

Link: CVE-2026-4355

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-24T10:54:19Z

Weaknesses