Description
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.
Medium · 6.5
CVE-2026-75460
EUVD-2026-68880GHSA-rw8f-gvg3-h72w
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page…
Published Aug 31, 2026 · Updated Sep 1, 2026 · Assigned by mitre