EUVD-2026-12686Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.5 score (low) might suggest minimal risk, contextual factors elevate actual exploitability concern. The attack requires low privileges and low complexity (AC:L, PR:L), with a public POC now available, placing this in the automatable exploitation category per SSVC principles. The availability of public exploit code and vendor non-responsiveness increase the probability of active exploitation in the wild. However, the requirement for prior authentication (PR:L) and user interaction (UI:R) limits the attack surface to logged-in users who must be socially engineered into clicking a malicious link. The integrity impact is limited (I:L) with no confidentiality or availability impact, meaning an attacker can modify page content viewed by victims but cannot access sensitive data or disrupt service. For organizations using i-Educar, this represents a moderate real-world risk due to availability of working exploits and lack of vendor remediation, but it is not a critical emergency for patched or segmented deployments. |
| Exploit ScenarioDerived | An attacker with valid i-Educar credentials (e.g., a teacher or administrator account) crafts a malicious URL containing JavaScript payload in the Name parameter of educar_servidor_curso_lst.php and sends it to another user via email or internal messaging. When the victim clicks the link while logged in, the injected script executes in their browser session, allowing the attacker to steal the session cookie, redirect the user to a phishing page, or perform actions on their behalf such as modifying grades or accessing student records. The public POC on GitHub makes it trivial for unskilled attackers to automate this attack against multiple users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
A stored or reflected cross-site scripting (XSS) vulnerability exists in Portabilis i-Educar 2.11 through improper input validation on the Name parameter in the /intranet/educar_servidor_curso_lst.php endpoint. An authenticated attacker can inject malicious JavaScript that executes in the context of other users' browsers, potentially enabling session hijacking, credential theft, or malware distribution. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure attempts, indicating no patch is currently available.
RemediationAI
Immediately contact Portabilis for a patched version of i-Educar, as the vendor has not publicly released a fix despite early notification; check their security advisories at their official website for any emergency patches. As an interim mitigation, deploy a Web Application Firewall (WAF) rule to filter requests containing encoded or raw JavaScript payloads in the Name parameter, restrict access to the /intranet/ path to trusted IP ranges using reverse proxy or firewall rules, and implement Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution. Additionally, conduct security awareness training to discourage users from clicking untrusted links within the application, and review access logs for any exploitation attempts using the public POC signatures available on GitHub.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a reflected or stored cross-site scripting (CWE-79) flaw in a PHP-based educational management system. The i-Educar application fails to properly sanitize or encode the Name parameter before rendering it in the HTTP response from the /intranet/educar_servidor_curso_lst.php component endpoint. The attack vector is network-based and requires prior authentication (PR:L per CVSS), but only requires user interaction (UI:R) to be exploited, suggesting the payload is likely embedded in a link or form submission that a victim must click. The PHP framework does not appear to implement sufficient output encoding or content security policy (CSP) headers to mitigate reflected XSS attacks.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in Portabilis i-Educar 2.11. This impacts an unknown function of the file /intranet/educar_servidor_curso_lst.php of the component Endpoint. Performing a manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
CVE-2026-4355 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Cross-Site Scripting (XSS) Vulnerabilities
View all 3In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB