Portabilis i-Educar CVE-2025-8366

Apply input validation and output encoding to the nome and matricula_servidor parameters in /intranet/educar_servidor_lst.php. Specifically, use HTML entity encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag) on all reflected parameters before rendering them in HTML context. If a vendor patch for version 2.9+ becomes available, upgrade immediately; currently, no patched version has been released by Portabilis (vendor non-responsive). As interim compensating controls: (1) Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers in the nome and matricula_servidor parameters-trade-off is potential false positives if legitimate data contains angle brackets; (2) Implement Content Security Policy (CSP) headers (e.g., script-src 'self') to prevent inline script execution-this blocks malicious scripts even if injected, but may break legitimate functionality if the application relies on inline scripts; (3) Restrict access to /intranet/ endpoints to authenticated users via network-level controls or reverse proxy authentication if operationally feasible. Monitor GitHub and vuldb.com for community-contributed patches or forks.