Tecnick

Tcexam

29 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
2.4

CVE-2026-4169

  • EPSS 0.03%
  • Veröffentlicht 15.03.2026 06:02:09
  • Zuletzt bearbeitet 16.03.2026 14:53:07

A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote ex...

2.4

CVE-2026-4168

Exploit
  • EPSS 0.03%
  • Veröffentlicht 15.03.2026 06:02:07
  • Zuletzt bearbeitet 16.03.2026 14:53:07

A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Such manipulation of the argument Name leads to cross site scripting. The attack may ...

8.8

CVE-2025-23176

  • EPSS 0.19%
  • Veröffentlicht 22.04.2025 14:23:42
  • Zuletzt bearbeitet 23.04.2025 14:08:13

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

6.1

CVE-2025-23175

  • EPSS 0.17%
  • Veröffentlicht 22.04.2025 12:24:37
  • Zuletzt bearbeitet 23.04.2025 14:08:13

Multiple XSS (CWE-79)

9.8

CVE-2024-47926

  • EPSS 0.09%
  • Veröffentlicht 30.12.2024 10:15:07
  • Zuletzt bearbeitet 30.12.2024 10:15:07

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

7.5

CVE-2024-47925

  • EPSS 0.13%
  • Veröffentlicht 30.12.2024 10:15:07
  • Zuletzt bearbeitet 30.12.2024 10:15:07

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.5

CVE-2023-6554

  • EPSS 0.24%
  • Veröffentlicht 11.01.2024 16:15:54
  • Zuletzt bearbeitet 21.11.2024 08:44:05

When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers.

6.1

CVE-2021-20116

Exploit
  • EPSS 0.26%
  • Veröffentlicht 05.08.2021 21:15:10
  • Zuletzt bearbeitet 21.11.2024 05:45:57

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path...

6.1

CVE-2021-20115

Exploit
  • EPSS 0.26%
  • Veröffentlicht 05.08.2021 21:15:10
  • Zuletzt bearbeitet 21.11.2024 05:45:57

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supp...

7.5

CVE-2021-20114

Exploit
  • EPSS 53.87%
  • Veröffentlicht 30.07.2021 14:15:14
  • Zuletzt bearbeitet 21.11.2024 05:45:56

When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.