Portabilis i-Educar CVE-2025-7867

No vendor-released patch has been identified; the vendor did not respond to early disclosure notification. Immediate remediation requires implementing input validation and output encoding: developers should modify the Agenda Module to sanitize novo_titulo and novo_descricao parameters using a whitelist-based HTML sanitizer (e.g., HTMLPurifier for PHP) on input, and apply HTML entity encoding (htmlspecialchars with ENT_QUOTES flag) on output rendering. For administrators unable to patch immediately, implement compensating controls: restrict Agenda Module access to trusted administrator accounts only via access control lists, disable the Agenda Module feature entirely if unused, or deploy a Web Application Firewall (WAF) with XSS filtering rules to block script tags in POST requests to /intranet/agenda.php (trade-off: may block legitimate rich-text content if agenda supports HTML formatting). Code review of all user input handling in the Agenda Module is recommended to identify similar input validation gaps. Organizations should contact Portabilis directly to request patched versions or migration guidance.