CVE-2025-1082

Mindskip xzs-mysql (3.9.0) has a Cross-Site Scripting (XSS) vulnerability in the Exam Edit Handler, specifically in /api/admin/question/edit. The issue arises from manipulating the title/content parameters of that API, allowing remote attackers to inject script. Public exploit information exists ...

PT-2025-5884

Name of the Vulnerable Software and Affected Versions Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description A problematic issue was found in the CORS Handler component, leading to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, but the complexity is...

CVE-2025-1082: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to...

PT-2025-5895

Name of the Vulnerable Software and Affected Versions Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description A problematic issue has been found, affecting some unknown functionality and leading to cross-site request forgery. The attack can be launched remotely and multiple endpoints are affected...

PT-2025-5883

Name of the Vulnerable Software and Affected Versions Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description A problematic issue has been found in the Exam Edit Handler component. The manipulation of the title and content arguments in the "/api/admin/question/edit" API endpoint leads to cross-sit...

CVE-2025-1083: Permissive Cross-domain Policy with Untrusted Domains

A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely...