CVE-2025-7870

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-7870
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7870.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-7870
Published
2025-07-20T05:32:06Z
Modified
2026-10-28T02:31:09Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Portabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scripting
Details

A vulnerability was identified in Portabilis i-Diario 1.5.0. The affected element is an unknown function of the file app/uploaders/doc_uploader.rb of the component justificativas-de-falta Endpoint. Such manipulation of the argument Anexo leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is 6c529bb2d96130aa29533f49e204e86518e11fdd. It is best practice to apply a patch to resolve this issue. The vendor confirms: "The attachment uploader now rejects files whose declared content type indicates executable or markup content".

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7870.json"
}
References

Affected packages

Git / github.com/portabilis/i-diario

Affected ranges

Type
GIT
Repo
https://github.com/portabilis/i-diario
Events
Introduced
685689f97027d75a456e3bc243e103b6bfc580d9
Fixed
6c529bb2d96130aa29533f49e204e86518e11fdd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.5.0"
                },
                {
                    "last_affected":  "1.5.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "6c529bb2d96130aa29533f49e204e86518e11fdd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7870.json"