Portabilis I-educar

Authenticated SQL Injection in i-Educar

Portabilis i-Educar edit sql injection

Portabilis i-Educar aluno sql injection

Portabilis i-Educar edit sql injection

Portabilis i-Educar view sql injection

Portabilis i-Educar Matricula API matricula improper authorization

Portabilis i-Educar view sql injection

Portabilis i-Educar Agenda agenda.php sql injection

Portabilis i-Educar Listagem de áreas de conhecimento edit sql injection

Portabilis i-Educar Listagem de áreas de conhecimento view sql injection

Portabilis i-Educar Formula de Cálculo de Média edit sql injection

Portabilis i-Educar Tabelas de Arredondamento view sql injection

Portabilis i-Educar Formula de Cálculo de Média view sql injection

Portabilis i-Educar processamentoApi improper authorization

Portabilis i-Educar consulta improper authorization

Portabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injection

Portabilis i-Educar consulta-dispensas improper authorization

Portabilis i-Educar enrollment-history access control

Portabilis i-Educar aluno improper authorization

Portabilis i-Educar unificacao-aluno improper authorization

Portabilis i-Educar periodo-lancamento improper authorization

Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

Portabilis i-Educar educar_historico_escolar_lst.php sql injection

Portabilis i-Educar agenda_preferencias.php sql injection

Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

Privilege escalation in i-Educar

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`

i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`

i-Educar Authenticated Time-based SQL Injection in `agenda.php`

Portabilis i-Educar diarioApi information disclosure

Portabilis i-Educar exportacao-para-o-seb access control

Portabilis i-Educar enturmacao-em-lote access control

Portabilis i-Educar cancelar-enturmacao-em-lote access control

Portabilis i-Educar enturmar access control

Reflected Cross-Site Scripting in i-Educar

Portabilis i-Educar educar_escolaridade_lst.php cross site scripting

Portabilis i-Educar educar_avaliacao_desempenho_lst.php cross site scripting

Portabilis i-Educar pesquisa_pessoa_lst.php cross site scripting

Portabilis i-Educar educar_servidor_lst.php cross site scripting