CVE-2025-3849

MEDIUM

Yxj2018 Springboot-vue-onlineexam - Password Reset Weakness

Title source: rule

Description

A vulnerability classified as problematic was found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This vulnerability affects unknown code of the file /api/studentPWD. The manipulation of the argument studentId leads to unverified password change. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References (4)

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.305776

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.305776

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.556283

[Exploit, Issue Tracking, Vendor Advisory] https://github.com/YXJ2018/SpringBoot-Vue-OnlineExam/issues/74

Scores

CVSS v3 4.3

EPSS 0.0020

EPSS Percentile 41.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-620 CWE-640

Status published

Products (1)

yxj2018/springboot-vue-onlineexam

Published Apr 22, 2025

Tracked Since Feb 18, 2026