PT-2026-25930 · Unknown · Speedexam Online Examination System

Maarckz · Published 2026-03-17 · Updated 2026-05-19 · CVE-2026-30707

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SpeedExam Online Examination System (SaaS) versions after v.FEV2026

Description The software contains a Broken Access Control issue via the ReviewAnswerDetails ASP.NET PageMethod. Authenticated attackers can bypass client-side restrictions and directly invoke this method to retrieve the full answer key. The affected API endpoint is ReviewAnswerDetails.

Recommendations Versions after v.FEV2026: Restrict access to the ReviewAnswerDetails PageMethod to authorized users only.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-30707

Affected Products

Speedexam Online Examination System

References · 7

• 🔥 https://github.com/Maarckz/VulnReports/blob/main/CVE-2026-30707.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30707 · Security Note
• https://github.com/Maarckz/VulnReports/blob/main/SpeedExam%20%28SECOPS.GROUP%29.md · Note
• https://twitter.com/CVEnew/status/2033994294743502907 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034040337170092204 · Twitter Post
• https://t.me/cveNotify/164067 · Telegram Post
• https://twitter.com/TheHackerWire/status/2034374243111317932 · Twitter Post