Is there a public PoC exploit available for EUVD-2025-20188?

Yes, a public proof-of-concept exploit is available for EUVD-2025-20188. Prioritise patching immediately. EPSS: 0.0%.

i-Educar EUVD-2025-20188

Q: What is the CVSS score of EUVD-2025-20188?

EUVD-2025-20188 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-7113 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-07 cna@vuldb.com

XSS I Educar

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

XSS requires authenticated low-privilege access and victim interaction; scope changes to victim browser enabling cookie theft and page manipulation.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20188

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

PoC Detected

Aug 13, 2025 - 14:42 vuln.today

Public exploit code

CVE Published

Jul 07, 2025 - 05:15 cve.org

LOW 2.0

CVE Published

Jul 07, 2025 - 05:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCurricular/edit?id=ID of the component Curricular Components Module. The manipulation of the argument Nome leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting in Portabilis i-Educar 2.9.0 allows an authenticated low-privilege user to inject malicious JavaScript through the unsanitized Nome parameter in the Curricular Components Module editor (/module/ComponenteCurricular/edit). When a victim with an active session views the affected component, the injected script executes in their browser context, enabling session hijacking or UI manipulation. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (7th percentile) indicates negligible observed exploitation activity to date, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

i-Educar is an open-source Brazilian school management ERP developed by Portabilis (CPE: cpe:2.3:a:portabilis:i-educar:2.9.0). The affected endpoint is the Curricular Components Module editor, where the Nome (Name) input field is insufficiently neutralized before being rendered back into the HTML page. This corresponds to CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored or reflected XSS root cause where user-controlled data is embedded in page output without proper encoding or content-security policy controls. The CVSS 4.0 vector confirms network reachability (AV:N), low complexity (AC:L), no special attack timing (AT:N), low privileges required (PR:L), and passive user interaction (UI:P), consistent with a typical authenticated persistent XSS pattern in a web application.

RemediationAI

No vendor-released patch is available at time of analysis - the vendor did not respond to the responsible disclosure. As immediate compensating controls, administrators should restrict write access to the Curricular Components Module to the minimum necessary user accounts, reducing the pool of authenticated users who could inject payloads. Deploying a Web Application Firewall rule to block common XSS patterns (e.g., <script>, javascript:, event handler attributes) in the Nome field input reduces automated exploitation risk, though WAF rules can be bypassed by skilled attackers. Implementing a strict Content-Security-Policy header for the application eliminates most XSS execution paths at the browser layer without touching application code. Organizations relying on i-Educar should monitor VulDB entry 315024 and the project's GitHub repository for any upstream patches from the vendor.