CVE-2026-4168

🗓️ 15 Mar 2026 06:02:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 43 Views🌐 WEB

Tecnick TCExam 16.5.0 has a cross site scripting flaw in tce_edit_group.php; upgrade recommended.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-4168	15 Mar 202606:02	–	attackerkb
CNNVD	Tecnick TCExam 代码注入漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-4168 Tecnick TCExam Group tce_edit_group.php cross site scripting	15 Mar 202606:02	–	cvelist
EUVD	EUVD-2026-12212	16 Mar 202615:30	–	euvd
NVD	CVE-2026-4168	16 Mar 202614:19	–	nvd
Positive Technologies	PT-2026-25541	15 Mar 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-4168: Improper Neutralization of Input During Web Page Generation	16 Mar 202600:00	–	rapid7
RedhatCVE	CVE-2026-4168	26 Mar 202615:15	–	redhatcve
Vulnrichment	CVE-2026-4168 Tecnick TCExam Group tce_edit_group.php cross site scripting	15 Mar 202606:02	–	vulnrichment

Vulners

Node

tecnick tcexamMatch16.5.0

[
  {
    "vendor": "Tecnick",
    "product": "TCExam",
    "versions": [
      {
        "version": "16.5.0",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Group Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/tecnickcom/tcexam/tags
github	www.github.com/ahmadmarz10-hub/CVEsMarz/blob/main/CVE%20Stored%20XSS.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
Name	query param	/admin/code/tce_edit_group.php	XSS via manipulation of the Name parameter in /admin/code/tce_edit_group.php (Group Handler) in Tecnick TCExam 16.5.0.	CWE-79, CWE-94

17 Jun 2026 10:56Current

3.7Low risk

Vulners AI Score3.7

CVSS 3.12.4

CVSS 32.4

CVSS 23.3

CVSS 44.8

EPSS0.0035

SSVC