{"id":"CVE-2025-10070","summary":"Portabilis i-Educar enturmacao-em-lote access control","details":"A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 2.12 is able to mitigate this issue. Patch name: d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component.","modified":"2026-10-28T02:30:35.314237816Z","published":"2025-09-07T22:02:06.539Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10070.json","cna_assigner":"VulDB","cwe_ids":["CWE-266","CWE-284"]},"references":[{"type":"WEB","url":"https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10070.md"},{"type":"WEB","url":"https://github.com/portabilis/i-educar/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10070.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10070"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2025-10070"},{"type":"ADVISORY","url":"https://vuldb.com/submit/644133"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/323018"},{"type":"REPORT","url":"https://vuldb.com/vuln/323018/cti"},{"type":"FIX","url":"https://github.com/portabilis/i-educar/commit/d53365e5656f6499a4deddf89d522814655f769d"},{"type":"FIX","url":"https://github.com/portabilis/i-educar/tree/2.12"},{"type":"EVIDENCE","url":"https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.enturmacao-em-lote.(ID)%60%20Endpoint.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/portabilis/i-educar","events":[{"introduced":"290beff8b941dd594038ab058b083c85651655e5"},{"fixed":"d53365e5656f6499a4deddf89d522814655f769d"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.0"},{"last_affected":"2.0"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.1"},{"last_affected":"2.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.2"},{"last_affected":"2.2"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.3"},{"last_affected":"2.3"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.4"},{"last_affected":"2.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"2.5"},{"last_affected":"2.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.6"},{"last_affected":"2.6"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"2.7"},{"last_affected":"2.7"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.8"},{"last_affected":"2.8"}]},{"range":[{"introduced":"2.9"},{"last_affected":"2.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2.10"},{"last_affected":"2.10"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d53365e5656f6499a4deddf89d522814655f769d"}]}]}}],"versions":["2.0","2.1","2.10","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.9","2.1.21","2.1.20","2.1.19","2.1.18","2.1.17","2.1.16","2.1.15","2.1.14","2.1.13","2.1.12","2.1.11","2.1.10","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.11","2.0.10","2.0.9","2.0.8.1","2.0.8","2.0.7","2.0.6","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10070.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}