Privilege Escalation in XueZhiSi Open Source Exam System

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: MITRE

Description

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-75460

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation issue in XueZhiSi Open Source Exam System version 3.9.0 or lower. It allows an attacker to manipulate the role parameter in the teacher-end interface POST /api/teacher/user/page/list to gain unauthorized elevated privileges.

Impact Analysis

If exploited, this vulnerability could allow an attacker to escalate their privileges within the system, potentially accessing sensitive data, modifying exam results, or performing unauthorized actions that require higher-level permissions.

Mitigation Strategies

Upgrade XueZhiSi Open Source Exam System to a version higher than 3.9.0 to address the privilege escalation vulnerability in the teacher-end interface.

Hi! I’m here to help you understand CVE-2026-75460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70