CVE-2025-1082

Summary

CVE-2025-1082 is a newly disclosed vulnerability affecting the Mindskip xzs-mysql 学之思开源考试系统 3.9.0. The issue lies within the Exam Edit Handler component and specifically the /api/admin/question/edit file. An attacker can exploit this vulnerability by manipulating the title/content argument, resulting in cross-site scripting (XSS). This attack can be launched remotely, allowing an attacker to inject malicious scripts into a user's browser. Despite early notification to the vendor, they have not responded, leaving systems running this version of the software potentially vulnerable to this publicly disclosed exploit.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.