CVE-2020-5748

Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks via the self-registration feature...

CVE-2020-5745

Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link...

CVE-2020-5745

CVE-2020-5745 : TCExam 14.2.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. A remote attacker can induce a user to perform sensitive actions by tricking them into clicking a crafted link. The NVD CVSS data shows a base score of 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/I:H/A:N) and 4.3 (CV...

CVE-2020-5746

Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks by creating a crafted test...

CVE-2020-5746

Summary: CVE-2020-5746 is a vulnerability in Tecnick.com TCExam (version 14.2.2) characterized by insufficient output sanitization that enables a remote, authenticated attacker to perform persistent cross-site scripting (XSS) by crafting a test. Affected component: TCExam web application (TCExam ...

CVE-2020-5743

This entry documents CVE-2020-5743 affecting TCExam 14.2.2. The vulnerability is described as improper access control (improper control of resource identifiers) that lets a remote, authenticated attacker access test metadata they should not be able to view. The connected records consistently iden...

CVE-2020-5743

Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission...

CVE-2020-5744

Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk...

CVE-2020-5744

CVE-2020-5744 affects Tecnick.com TCExam 14.2.2. The vulnerability is a Relative Path Traversal that could allow a remote, authenticated attacker to read arbitrary files on disk. The connected records confirm the product/version and impact, but do not provide exploit details, affected editions be...

CVE-2020-5747

Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks by creating a crafted test...

CVE-2020-5747

TCExam 14.2.2 contains a cross-site scripting (XSS) vulnerability due to insufficient output sanitization. A remote, authenticated attacker can create a crafted test to persist XSS. No patch/firmware version or remediation is detailed in the provided documents.

TCExam Cross-Site Scripting Vulnerability (CNVD-2018-13449)

TCExam is a web-based open source online examination system for online test question generation, management and other aspects. A cross-site scripting vulnerability exists in versions of TCExam prior to 14.1.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

Design/Logic Flaw

TCExam before 14.1.2 has XSS via an ff or xl field...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

CVE-2018-13422

TCExam prior to 14.1.2 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via inputs in ff_ or xl_ fields. The issue affects the web-based open source TCExam system and is documented across multiple sources (e.g., CNVD-2018-13449, NVD/CVE-2018-13422, Red Hat advisory)...

TCExam 12.2.5 Information Disclosure

--------------------------------------------------------- Correct answer Information Disclosure in TCExam " element for each multiple-choice answer has an "id" attribute with a numeric value indicating in which position the answer was created. Therefore the lowest "id" will always be the right...

TCExam <= 4.0.011 (SessionUserLang) Shell Injection Exploit

No description provided by source. ?php printr' -------------------------------------------------------------------------- TCExam = 4.0.011 $COOKIESessionUserLang shell injection exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...

TCExam <= 11.2.011 - Multiple SQL Injection Vulnerabilities

No description provided by source. TCExam =11.2.011 Multiple SQL Injection Vulnerabilities Vendor: Tecnik.com s.r.l. Product web page: http://www.tcexam.org Affected version: 11.2.009, 11.2.010 and 11.2.011 Summary: TCExam is a FLOSS system for electronic exams also know as CBA - Computer-Based...