CNNVD-202509-2691 Information

Sep 17, 2025 cve

CNNVD ID

CNNVD-202509-2691

CVE-2025-10607

CNNVD Published: 2025-09-17

Description (Chinese)

i-Educar是Portábilis开源的一个免费教育软件。 i-Educar 2.10及之前版本存在访问控制错误漏洞，该漏洞源于文件/module/Avaliacao/diarioApi中未知函数操作不当，可能导致信息泄露。

Description (English)

i-Educar is a free education software from Portábilis. i-Educar 2.10 and previous versions contain access control error loopholes that stem from the improper operation of unknown functions in the file/module/Avaliacao/diarioApi, which may lead to the disclosure of information.

Hazard Level

High

Vulnerability Type

访问控制错误

Affected Vendor

PostHog

Published

2025-09-17

Last Modified

2026-02-24

References

https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Avaliacao.diarioApi.md https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10607.md https://vuldb.com/?ctiid.324627 https://vuldb.com/?id.324627 https://vuldb.com/?submit.649875

Share on: