CVE-2026-75458

XueZhiSi Open Source Exam System versions 3.9.0 and earlier contain a vertical privilege escalation vulnerability in the teacher-end endpoint POST /api/teacher/user/delete/{id} . The endpoint accepts a user ID and performs a deletion sequence (getUserById, setDeleted, updateByIdFilter) without va...

EUVD-2026-68880

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-75460

XueZhiSi Open Source Exam System (versions