Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-9606

CVE-2025-9606LOW

Portabilis i-Educar agenda_preferencias.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0034   24.7     —

AFFECTED
  Product   Versions  Fixed
  i-Educar  2.0 –     2.12

TIMELINE
  Aug 28  Reserved by VulDB
  Aug 29  Published (CNA: VulDB)
  Sep 15  RESCORED — CVE-2025-9606 (Portabilis i-Educar). CVSS 5.3 → 2.1 (NVD).

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Modified

Description

A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.12 addresses this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 28, 2025	Reserved	Reserved by VulDB
August 29, 2025	Published	Published (CNA: VulDB)
September 15, 2026	RESCORED	RESCORED — CVE-2025-9606 (Portabilis i-Educar). CVSS 5.3 → 2.1 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Portabilis	i-Educar	—	2.0	2.12

Weaknesses

CWE-74 · CWE-89

References (8)

https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9606.md [Exploit, Issue Tracking]
https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20cod_agenda%20Parameter%20on%20agenda_preferencias.php%20Endpoint.md#poc [Broken Link]
https://github.com/portabilis/i-educar/tree/2.12
https://vuldb.com/?submit.636577 [Third Party Advisory, VDB Entry]
https://vuldb.com/cve/CVE-2025-9606
https://vuldb.com/submit/636577
https://vuldb.com/vuln/321784
https://vuldb.com/vuln/321784/cti

Authoritative record: CVE-2025-9606 at cve.org

Vendors: portabilis

Weaknesses: CWE-74 · CWE-89

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-9606 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.