I Educar CVE-2025-7113

We need to produce a JSON object with the specified fields. The input provides CVE-2025-7113, Portabilis i-Educar 2.9.0, XSS in Curricular Components Module, CVSS 4.0 vector given. We'll synthesize.

Product name: "i-Educar" (that's the product, 1-3 words). Actually the product is "i-Educar" by Portabilis. But the description says "Portabilis i-Educar". Product name: "i-Educar". It fits.

Summary: Not copy description. Original synthesis: Cross-site scripting in i-Educar 2.9.0's Curricular Components editing page allows remote attackers to inject arbitrary web script via the "Nome" parameter. The vulnerability is publicly disclosed with a POC available, but no evidence of active exploitation. Low severity due to required low privileges and user interaction.

Technical context: CWE-79 reflected XSS. Affects i-Educar 2.9.0 exactly (CPE). It's a web application, PHP-based probably. The parameter "Nome" in the component editing URL. We'll mention that.

Risk assessment: CVSS 4.0 vector: AV:N/AC:L/PR:L/UI:P, meaning network, low attack complexity, low privileges required, passive user interaction. VC:N, VI:L, VA:N, so manipulated victim sees content, no confidentiality/availability impact. EPSS 0.03% (low) so low exploitation probability. No KEV. POC exists. So overall risk low. SSVC: exploitation: none, automatable: yes (XSS is usually automatable), technical impact: partial (only integrity impact on victim browser). So it's a low priority. Not actively exploited. No response from vendor, so patch status unknown.

Affected products: i-Educar version 2.9.0 (CPE: cpe:2.3:a:portabilis:i-educar:2.9.0). No other versions known. Vendor did not respond, so no advisory from vendor. References only VulDB and EUVD.

Remediation: No patch from vendor. VulDB suggests no response. Workarounds: disable the component editing page? Or restrict access to authenticated users? But PR:L already required, so the fix would be output encoding of "Nome" parameter. Since no patch, recommend input validation/sanitization and output encoding in the application layer, or use web application firewall to block XSS payloads. Compensating controls: Restrict access to the module to trusted users? Not good because low-privileged user could exploit against higher-privileged user. So use WAF, or update to newer version if available (but not provided). The advisory URL vuldb.com/?id.315024 may have info, but we'll say no vendor patch; implement custom fix. Trade-off: WAF may miss obfuscated payloads; custom fix requires code change.

Exploit scenario: Authenticated low-privileged attacker crafts a malicious URL with JavaScript payload in the "Nome" parameter and tricks an admin user into clicking it, stealing session cookies or performing actions in the context of the victim's browser. POC available.

Exploitation conditions: Must have a valid low-privilege account on the i-Educar instance, and the victim user must visit the crafted URL with the "Nome" parameter while authenticated. User interaction is required (passive, i.e., victim clicks link). No specific feature enablement beyond default installation.

Attack chain: Authenticate as low-privilege user (optional if unauthenticated? Actually PR:L means need to be authenticated. So step: Obtain credentials or access as low-privilege user? But the attacker might be authenticated, but the victim is the target. Attack chain: Authenticated user crafts XSS payload -> Delivers malicious link to victim admin -> Victim opens link while authenticated -> XSS executes in victim's browser -> Impact: script execution in victim's session. So chain: Authenticate as low-privilege user → Craft XSS payload in “Nome” parameter → Send crafted URL to victim → Victim clicks link while authenticated → XSS executes in victim’s browser → Steal session or perform actions.

But CVSS vector says PR:L for attack privileges, so attacker needs low privileges. So step 1: Attacker logs in with low-privilege account. The crafted URL involves the "edit" page which typically may require some privileges? But PR:L means attacker with low privilege can craft exploit? That doesn't require logging in to construct URL; anyone can craft the URL, but the vulnerable endpoint /module/ComponenteCurricular/edit?id=ID presumably requires authentication to access, so the victim must be authenticated, but the attacker doesn't need to be authenticated to create the URL. However, the CVSS PR:L indicates "privileges required" for the attack to succeed, meaning the attacker must have some privileges. This is ambiguous: For stored XSS, PR may be low if attacker needs to login to store payload. For reflected, usually PR:N. Here, CVSS:4.0 has PR:L. So likely the attacker needs to be authenticated to access the feature that allows crafting the link? No, the attacker might need to be logged in to the application to cause the victim to be affected? In reflected XSS, the vulnerable parameter is in URL, and the victim just needs to be logged in when clicking. The attacker does not need to be logged in. Yet PR:L in CVSS means "the attacker must possess some privileges to exploit". That suggests perhaps the vulnerable endpoint requires authentication to render the page with the parameter. So the victim must be authenticated, but the attacker doesn't need to be. However, in CVSS v3.1 and v4.0, PR is about the attacker's privileges, not the victim's. So if exploiting the vulnerability requires the attacker to be authenticated (e.g., to access the edit page), then PR:L. I think that's the case: The vulnerable file /module/ComponenteCurricular/edit?id=ID is likely accessible only to authenticated users. But if the attacker can craft a URL that a logged-in user clicks, and the attacker doesn't need to be authenticated, it would be PR:N. However, the CVSS vector says PR:L, so I'll trust that the exploitation requires the attacker to be authenticated (i.e., low-privilege user can craft the URL that includes the XSS payload, and then send to victim). But that seems odd: you could still send a crafted URL without being authenticated; it's just the exploitation of the XSS on the victim requires the victim to be authenticated. The PR metric is "Privileges Required" for the attacker. If the vulnerable component is the web application, and the attacker can only deliver the payload if they have an account (e.g., stored XSS), then PR:L. For reflected, typically PR:N. The description says "manipulation of the argument Nome leads to cross site scripting. It is possible to launch the attack remotely." It doesn't mention authentication requirement. The CVSS vector was provided by VulDB, so they set PR:L. So I'll go with that: exploitation requires low privileges. Attack chain then: Attacker logs in with low-privilege account → Constructs malicious URL with XSS payload in Nome parameter → Sends link to higher-privileged victim → Victim, already authenticated, clicks link → XSS payload executes → Impact.

Simplified chain: Authenticate as low-privilege user → Craft XSS payload → Deliver link to victim → Victim opens link → XSS executes → Impact.

Will use that.

Confidence notes: Confirm: VulDB disclosed, NVD entry, CWE-79, POC available on GitHub, no vendor response. So confirmed that it's XSS, no patch, and no active exploitation. Missing: Vendor advisory, whether a fix exists. Inferred: Patch status unknown. Confidence moderate.

Prevalence: i-Educar is a Brazilian school management software. It's a niche product deployed in educational institutions, primarily in Brazil. I'd say low, maybe medium? But it's not ubiquitous. Likely low deployment footprint worldwide. Prevalence: low. Justification: "Brazilian school management software, limited global deployment". So prevalence_basis: "niche school management system, mainly in Brazil".

Assessed CVSS vector: I'll provide my own CVSS 3.1 base vector given the vulnerability: reflected XSS, network vector, low complexity, no privileges required? but the CVSS 4.0 says PR:L, so for 3.1 I'd set PR:L as well. So AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N (scope changed because XSS can affect victim's browser context outside of application? Actually for reflected XSS, scope is usually unchanged because the vulnerable component and impacted component are the same application. But if the XSS executes in victim's browser, it can be considered scope unchanged (the impact is on the same vulnerable component as the victim's session). NVD's CVSS 3.1 examples for reflected XSS often show scope unchanged. I'll use S:U/C:N/I:L/A:N. That would be: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. But some use C:L/I:L for content spoofing? The CVSS 4.0 VI:L only, no confidentiality. For 3.1, I:L alone. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. Rationale: Requires authentication (low priv) and user interaction; only impacts integrity of displayed content. Not actively exploited. That's consistent.

CVSS 4.0 vector: The provided vector is for the assessment? It says "CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X". We are to provide our own assessed vector consistent with 3.1. I'll produce a CVSS 4.0 base vector (no temporal/environment), using AT:N as default. So for the same assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. That matches the given vector (excluding the E:P and X's), so I'll just output the base vector. Actually the given vector includes E:P and all X's. I'll strip to base: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Rationale: consistent with assessed 3.1 vector.

Now, produce JSON. Ensure strings, not arrays. Use the product name "i-Educar". Summary: "Cross-site scripting in Portabilis i-Educar 2.9.0 Curricular Components Module allows authenticated remote attackers to inject arbitrary web script via the 'Nome' parameter. A public proof-of-concept exploit exists, but no active exploitation has been confirmed." I'll incorporate that.

Technical context: "The vulnerability resides in the PHP-based i-Educar web application's Curricular Components Module editing page (file /module/ComponenteCurricular/edit). It stems from insufficient output encoding of the 'Nome' parameter, classified as CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Only version 2.9.0 is confirmed affected per CPE: cpe:2.3:a:portabilis:i-educar:2.9.0."

Risk assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) indicates a low-severity flaw requiring authenticated low privileges and user interaction to inject script that modifies the victim's view. The EPSS score of 0.03% indicates a very low probability of exploitation. While exploit code is publicly available, it is not listed in CISA KEV, and there are no reports of active exploitation. The impact is limited to content spoofing or session hijacking in the victim’s browser, with no direct system compromise. The vendor has not responded, leaving patch availability unknown. Overall risk is low."

Affected products: "Portabilis i-Educar version 2.9.0 (CPE: cpe:2.3:a:portabilis:i-educar:2.9.0). No other versions are confirmed vulnerable. The vendor was contacted but did not respond. No official advisory or patch version is available. Reference: VulDB entry 315024."

Remed