Zhuimengshaonian vulnerabilities
Published CVEs affecting Zhuimengshaonian products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-11321
Medium · 4.3
CWE-285 Oct 6, 2025
zhuimengshaonian wisdom-education WrongBookController.java authorization
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.
CVE-2025-11320
Medium · 6.3
CWE-284 Oct 6, 2025
zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-11080
Medium · 4.3
CWE-266 Sep 27, 2025
zhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorization
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. This vulnerability affects the function selectStudentExamInfoList of the file src/main/java/com/education/api/controller/student/ExamInfoController.java. Such manipulation of the argument subjectId leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.