CVE-2025-3849

MEDIUM

Yxj2018 Springboot-vue-onlineexam - Password Reset Weakness

Title source: rule

Description

A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References (4)

[Exploit, Issue Tracking, Vendor Advisory] https://github.com/YXJ2018/SpringBoot-Vue-OnlineExam/issues/74

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.305776

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.305776

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.556283

Scores

CVSS v3 4.3

EPSS 0.0020

EPSS Percentile 41.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-620 CWE-640

Status published

Affected Products (1)

yxj2018/springboot-vue-onlineexam

Timeline

Published Apr 22, 2025

Tracked Since Feb 18, 2026