PT-2026-25930 · Unknown · Speedexam Online Examination System

Maarckz · Publicado 2026-03-17 · Atualizado 2026-05-19 · CVE-2026-30707

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SpeedExam Online Examination System (SaaS) versions after v.FEV2026

Description The software contains a Broken Access Control issue via the ReviewAnswerDetails ASP.NET PageMethod. Authenticated attackers can bypass client-side restrictions and directly invoke this method to retrieve the full answer key. The affected API endpoint is ReviewAnswerDetails.

Recommendations Versions after v.FEV2026: Restrict access to the ReviewAnswerDetails PageMethod to authorized users only.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-30707

Produtos afetados

Speedexam Online Examination System

Referências · 7

• 🔥 https://github.com/Maarckz/VulnReports/blob/main/CVE-2026-30707.md · Exploit
• https://github.com/Maarckz/VulnReports/blob/main/SpeedExam%20%28SECOPS.GROUP%29.md · Nota
• https://twitter.com/CVEnew/status/2033994294743502907 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30707 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034040337170092204 · Publicação no Twitter
• https://t.me/cveNotify/164067 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2034374243111317932 · Publicação no Twitter