medium6.5
CVE-2026-75460
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list.
Impact
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.
Affected products
| Product | Affected versions |
|---|---|
| XueZhiSi Open Source Exam System | through 3.9.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.