Filtered by vendor Xuezhisi
Subscriptions
Filtered by product Open Source Exam System
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75458 | 1 Xuezhisi | 1 Open Source Exam System | 2026-09-01 | N/A |
| The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation. | ||||
| CVE-2026-75460 | 1 Xuezhisi | 1 Open Source Exam System | 2026-09-01 | N/A |
| XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester. | ||||
Page 1 of 1.