Vulnerabilities

TI-2025-00922 CVE-2025-1084 · GHSA-2qq7-6jm7-rjcv

Mindskip xzs-mysql 学之思开源考试系统 cross-site request forgery

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00323 Published 2025-02-06 No fix listed CWE-352

TI-2025-00921 CVE-2025-1083 · GHSA-m9wx-4528-xxff

MEDIUM 45

A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00329 Published 2025-02-06 No fix listed CWE-346

TI-2025-00920 CVE-2025-1082 · GHSA-m55v-j6cf-ff8q

MEDIUM 56

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0039 Published 2025-02-06 No fix listed CWE-79

TI-2024-19446 CVE-2024-29401 · GHSA-jwr6-j6qm-w9jv

HIGH 82

xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00784 Published 2024-03-26 No fix listed CWE-613

TI-2022-19890 CVE-2022-41431 · GHSA-4j4x-4j2g-pccj

LOW 28

xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00855 Published 2022-10-17 No fix listed CWE-79

TI-2021-21054 CVE-2021-46086 · GHSA-7vm3-67hm-9frc

LOW 34

xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00795 Published 2022-01-25 No fix listed CWE-276