CVE-2025-11080

MediumCVSS 4.3

Published: 27/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability has been detected in zhuimengshaonian wisdom-education (up to 1.0.4) in the selectStudentExamInfoList function of ExamInfoController.java. Manipulation of the subjectId argument leads to improper authorization. The exploit has been publicly disclosed.

Risk Assessment

An attacker can remotely access student exam information without proper authorization, potentially breaching the confidentiality of educational data.

Recommendation

Update wisdom-education to a version later than 1.0.4 or fix access control in the selectStudentExamInfoList function. Verify user permissions.

Other vulnerabilities in wisdom-education

CVE-2025-11321Medium
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.

Original NVD description (English source)

A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoController.java. Such manipulation of the argument subjectId leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS