4 matches found
EUVD-2026-68880
XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...
CVE-2026-75458
XueZhiSi Open Source Exam System versions 3.9.0 and earlier contain a vertical privilege escalation vulnerability in the teacher-end endpoint POST /api/teacher/user/delete/{id} . The endpoint accepts a user ID and performs a deletion sequence (getUserById, setDeleted, updateByIdFilter) without va...
EUVD-2026-68881
The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...