What’s Vulnerable › Vulnerabilities

CVE-2025-3849: YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-22 · updated 2026-06-17
• Weakness: CWE-620

Description

A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

• YXJ2018 SpringBoot-Vue-OnlineExam: all versions

References

• https://github.com/YXJ2018/SpringBoot-Vue-OnlineExam/issues/74
• https://vuldb.com/?ctiid.305776
• https://vuldb.com/?id.305776
• https://vuldb.com/?submit.556283

Get alerted when CVE-2025-3849 or the next vulnerability affects your stack