A vulnerability has been found in Portabilis i-Diario up to 1.5.0 and classified as problematic. (CVE-2025-8787)

CVE-2025-8787 is a cross-site scripting vulnerability in Portabilis i-Diario versions up to 1.5.0. It affects an unspecified functionality within the /registros-de-conteudos-por-disciplina/ file of the Registro das atividades component. The vulnerability is triggered by manipulation of the 'Registro de atividades/Conteúdos' argument, enabling remote attackers to execute script code in the context of the affected application. The vulnerability has a CVSS 3.1 base score of 3.5, indicating low to medium impact primarily on integrity. The vendor was contacted early but did not provide any response or patch. Public exploit information is available, but no known active exploitation has been reported.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the 'Registro de atividades/Conteúdos' argument. This can lead to limited integrity impact such as script execution in the victim's browser context. There is no reported impact on confidentiality or availability. No active exploitation in the wild has been confirmed.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should apply general XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates or patches. Since no official fix exists, cautious use of the affected functionality is advised.