CVE-2025-7110 is a cross-site scripting (XSS) vulnerability identified in version 2.9.0 of Portabilis i-Educar, an educational management software platform. The vulnerability resides in the School Module, specifically in the /intranet/educar_escola_lst.php file. It is triggered by manipulation of the 'Escola' parameter, which is not properly sanitized or encoded before being reflected in the web application response. This allows an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability is remotely exploitable without authentication, requiring only user interaction to trigger the malicious payload. The CVSS 4.0 base score is 5.1, indicating a medium severity level. The vector details show network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:L - low privileges), user interaction required (UI:P), and no impact on confidentiality or availability but low impact on integrity (VI:L). The vendor was notified but did not respond or provide a patch, and the exploit details have been publicly disclosed, increasing the risk of exploitation. Although no known exploits are currently reported in the wild, the public disclosure and lack of vendor response heighten the urgency for mitigation. The vulnerability could be leveraged to steal session cookies, perform actions on behalf of authenticated users, or conduct phishing attacks within the i-Educar intranet environment.

For European organizations using Portabilis i-Educar, particularly educational institutions, this vulnerability poses a risk of session hijacking, unauthorized actions, and data manipulation within the school management system. The impact is primarily on the integrity and trustworthiness of the application, potentially leading to unauthorized changes in student records or administrative data. Confidentiality impact is limited but could be escalated if combined with other vulnerabilities. The requirement for user interaction means phishing or social engineering could be used to exploit the flaw. Disruption of educational services or reputational damage could result if attackers leverage this vulnerability to deface portals or inject misleading information. Given the sensitive nature of educational data and the increasing digitalization of school administration in Europe, exploitation could undermine data protection compliance (e.g., GDPR) and erode stakeholder trust.

Organizations should immediately implement input validation and output encoding on the 'Escola' parameter within the affected module to neutralize malicious scripts. Since no official patch is available, applying web application firewall (WAF) rules to detect and block suspicious payloads targeting this parameter is critical. Restricting user privileges to the minimum necessary can reduce the impact of exploitation. Educating users about phishing risks and suspicious links can mitigate user interaction requirements. Network segmentation of the intranet hosting i-Educar can limit exposure. Monitoring logs for unusual activity related to the School Module and the 'Escola' parameter is recommended. If feasible, consider temporarily disabling or restricting access to the vulnerable module until a vendor patch or official fix is released. Organizations should also engage with Portabilis for updates and consider alternative solutions if the vendor remains unresponsive.