Tecnick TCExam 16.5.0 Group tce_edit_group.php Name cross site scripting ⚔ [Disputed]

Summaryinfo

A vulnerability marked as problematic has been reported in Tecnick TCExam 16.5.0. Affected is an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Performing a manipulation of the argument Name results in cross site scripting. This vulnerability is known as CVE-2026-4168. Remote exploitation of the attack is possible. Furthermore, an exploit is available. There are still doubts about whether this vulnerability truly exists. It is suggested to upgrade the affected component. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Tecnick TCExam 16.5.0. This affects an unknown code of the file /admin/code/tce_edit_group.php of the component Group Handler. The manipulation of the argument Name with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-4168. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release. By approaching the search of inurl:admin/code/tce_edit_group.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12212). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Tecnick

Name

• TCExam

Version

• 16.5.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #769826: Tecnick TCExam 16.5.0 Cross Site Scripting (by AhmadMarzouk)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion