Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-65022

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.

Published

2025-11-19T16:15:49.417

Last Modified

2025-11-20T17:24:07.987

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application portabilis i-educar ≤ 2.10.0 Yes
References