CVE-2026-4168

Tecnick TCExam Group tce_edit_group.php cross site scripting

View on CVE.org
Published Mar 15, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The presence of this vulnerability remains uncertain at this time. The affected component should be upgraded. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release.

Analysis

AI-generated

Technical impact

A stored cross‑site scripting flaw exists in the Group Handler of Tecnick TCExam 16.5.0, where an attacker can inject malicious JavaScript by manipulating the Name parameter in the /admin/code/tce_edit_group.php script. Because the application stores the injection without proper encoding, scripts are executed in the browsers of users who view the affected group data. Attackers could steal session cookies, deface content, or carry out further phishing attacks.

Affected Systems

The vulnerability impacts TCExam 16.5.0 released by Tecnick. No other versions are explicitly listed, and the vendor states that newer releases contain a fix, so users should verify that their installation is updated beyond 16.5.0.

Risk and Exploitability

The CVSS base score is 4.8, indicating moderate severity, and the EPSS score is below 1 percent, suggesting low exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Attackers would need remote access to the web interface and a crafted request to the group editing endpoint; the vulnerability is exploitable through standard HTTP calls.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade TCExam to the latest release that removes the XSS issue
  • Verify that the Name field is properly sanitized or encoded, and that the application’s input validation routines are active
  • Monitor web application logs for unexpected POST requests to /admin/code/tce_edit_group.php

Generated by OpenCVE AI on March 21, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The presence of this vulnerability remains uncertain at this time. The affected component should be upgraded. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release.
Title Tecnick TCExam Group tce_edit_group.php cross site scripting
First Time appeared Tecnick
Tecnick tcexam
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*
Vendors & Products Tecnick
Tecnick tcexam
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 16, 2026, 3:45 PM
Reserved
Mar 14, 2026, 12:47 PM

View source JSON

Updated
Mar 16, 2026, 3:45 PM

JSON

Status
Deferred
Published
Mar 16, 2026, 2:19 PM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Mar 23, 2026, 2:02 PM

JSON