Portabilis i-Educar CVE-2025-8369

No vendor-released patch has been identified at time of analysis. Given the vendor's non-response to disclosure, remediation relies on compensating controls. Implement a Web Application Firewall (WAF) rule to block HTTP requests containing script tags or event handlers in the titulo_avaliacao parameter; configure input validation to reject special characters (< > " ' &) in the parameter and require alphanumeric-only input; apply output encoding to all user-controlled variables before rendering in HTML context using PHP htmlspecialchars() or equivalent; restrict access to /intranet/ paths to authenticated users only via .htaccess or reverse proxy rules; consider disabling the affected feature entirely if not critical to operations. If feasible, migrate to a maintained educational platform with active security support, as the vendor's unresponsiveness indicates likely discontinuation of the product.