The vulnerability is a cross‑site scripting flaw in the XML export function (F_xml_export_users) of Tecnick TCExam. An attacker who can manipulate the XML export payload can inject malicious script that will be executed in the context of an administrator browsing the exported file. The flaw is tied to CWE‑79 and CWE‑94, indicating input validation and potentially code injection issues. While the vendor has expressed uncertainty about the real impact, the symptom allows arbitrary script execution when the exploit is executed.

Affected versions are all releases of Tecnick TCExam up to, and including, 16.6.0. The control file involved is admin/code/tce_xml_users.php. Version 16.6.1 contains the fix, referenced by the commit hash 899b5b2fa09edfe16043f07265e44fe2022b7f12. The patch is included in the 16.6.1 release on the vendor’s site and GitHub.

CVSS scores place the severity at 4.8, a moderate rating, and the EPSS score is below 1 %, indicating that exploit attempts are expected to be rare. The vulnerability is not catalogued in the CISA KEV list, which further suggests low exploitation likelihood. Remote exploitation is theoretically possible but requires administrative access to create an export and then consume it, meaning that an attacker with such privileges can already accomplish most control functions. In effect, the risk to a system lacking privileged user compromise is limited, and the practical threat is moderate.