CVE-2025-1082 MEDIUM

CVE-2025-1082: Mindskip xzs-mysql 学之思开源考试系统 Exam Edit edit cross site scripting

Vendor Mindskip
Product xzs-mysql 学之思开源考试系统
Weakness CWE-79 · XSS
Published February 6, 2025
Last update February 7, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

February 6, 2025 CVE published
February 7, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-2692 SourceCodester ICT Laboratory Management System GET Parameter room_info.php cross site scripting CVE-2025-32129 WordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability CVE-2025-62036 WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-53773 WordPress Znajdź Pracę z Praca.pl plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2