CVE•Published 2025-10-09•Modified 2026-10-08•0 articles on news•5 live references•NVD data
CVE-2025-11554Portabilis · I-educar
Vulnerability data via NVD (ingested)
CVSS v3.1
6.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS percentile
30
Exploit Prediction Scoring System · top 70% of all CVEs
Description
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Timeline
Published 2025-10-09
Modified 2026-10-08
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2025-11554Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product
product:"Portabilis I-educar"All exposed Portabilis I-educar instances — cross-reference with the CVE's affected-version range.
Shodan · banner/body mention
http.html:"I-educar"HTTP body or banner mentions "I-educar" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2025-11554Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2025-11554Censys host search filtered to this CVE id.
grep.app
CVE-2025-11554Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2025-11554GitHub code search for direct mentions.
Google dork
"CVE-2025-11554" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (3)
CVE-2025-115543 repos
XuzhaoLi/ro-arxiv-dailyPython
Automatically Update Arxiv Papers about Path Planning, LLM and Autonomous Driving using Github Actions since 2024.2.
YuzeHao2023/daily-arxiv-ai4geoPython
🎓Automatically Update AI4Geo Papers Daily using Github Actions
m3m0o/portabilis-ieducar-user-type-privilege-escalationPython
Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation through arbitrary requests to user type…
We haven't classified any articles referencing CVE-2025-11554 yet. The external references above still apply.