A vulnerability has been found in Portabilis i-Diario 1.5.0 and classified as problematic. (CVE-2025-7871)

CVE-2025-7871 describes a cross-site scripting vulnerability in Portabilis i-Diario 1.5.0. The flaw is located in the handling of the filter[by_description] argument within the /conteudos file, which allows remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability requires low attack complexity and privileges but user interaction is needed. The vendor was notified but has not issued a response or fix. Public exploit details have been disclosed.

Successful exploitation could allow an attacker to execute malicious scripts in the context of a user's browser, potentially leading to session hijacking or other client-side impacts. The vulnerability does not affect confidentiality or availability directly and requires user interaction. The overall impact is limited to integrity of client-side data.

No official fix or patch is currently available from the vendor. Users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates. Consider restricting access to the vulnerable endpoint or employing web application firewalls to detect and block malicious payloads.