Portabilis i-Educar CVE-2025-8368

No vendor-released patch has been identified at the time of analysis; the vendor did not respond to disclosure. Immediate workarounds include: (1) Apply input validation and output encoding to the campo_busca and cpf parameters in pesquisa_pessoa_lst.php by using htmlspecialchars() or a templating engine with auto-escaping before rendering user input in HTML context; (2) Deploy a Web Application Firewall (WAF) rule to block requests containing <script>, javascript:, or event handlers (onerror=, onclick=, etc.) in the campo_busca and cpf parameters; (3) Restrict access to the /intranet module via network-level controls (IP whitelisting, VPN requirement) if the search function is not critical for all users; (4) Implement Content Security Policy (CSP) headers to restrict inline script execution (trade-off: may require refactoring of legitimate inline scripts). Organizations should contact Portabilis directly to request a patched version or end-of-life timeline. If no response is received, consider evaluating alternative open-source or commercial educational management systems with active security maintenance.