CVE-2020-5744

CVE-2020-5744 affects Tecnick.com TCExam 14.2.2. The vulnerability is a Relative Path Traversal that could allow a remote, authenticated attacker to read arbitrary files on disk. The connected records confirm the product/version and impact, but do not provide exploit details, affected editions be...

CVE-2020-5747

TCExam 14.2.2 contains a cross-site scripting (XSS) vulnerability due to insufficient output sanitization. A remote, authenticated attacker can create a crafted test to persist XSS. No patch/firmware version or remediation is detailed in the provided documents.

CVE-2020-5747

Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks by creating a crafted test...

TCExam Cross-Site Scripting Vulnerability (CNVD-2018-13449)

TCExam is a web-based open source online examination system for online test question generation, management and other aspects. A cross-site scripting vulnerability exists in versions of TCExam prior to 14.1.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

Design/Logic Flaw

TCExam before 14.1.2 has XSS via an ff or xl field...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

CVE-2018-13422

TCExam prior to 14.1.2 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via inputs in ff_ or xl_ fields. The issue affects the web-based open source TCExam system and is documented across multiple sources (e.g., CNVD-2018-13449, NVD/CVE-2018-13422, Red Hat advisory)...

CVE-2018-13422

TCExam before 14.1.2 has XSS via an ff or xl field...

TCExam 12.2.5 Information Disclosure

--------------------------------------------------------- Correct answer Information Disclosure in TCExam " element for each multiple-choice answer has an "id" attribute with a numeric value indicating in which position the answer was created. Therefore the lowest "id" will always be the right...

TCExam <= 11.2.011 - Multiple SQL Injection Vulnerabilities

No description provided by source. TCExam =11.2.011 Multiple SQL Injection Vulnerabilities Vendor: Tecnik.com s.r.l. Product web page: http://www.tcexam.org Affected version: 11.2.009, 11.2.010 and 11.2.011 Summary: TCExam is a FLOSS system for electronic exams also know as CBA - Computer-Based...

TCExam <= 4.0.011 (SessionUserLang) Shell Injection Exploit

No description provided by source. ?php printr' -------------------------------------------------------------------------- TCExam = 4.0.011 $COOKIESessionUserLang shell injection exploit by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org...

CVE-2012-4601

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the 1 usergroups parameter to admin/code/tceedittest.php or 2 subjectid parameter to...

CVE-2012-4602

Multiple cross-site scripting XSS vulnerabilities in admin/code/tceselectuserspopup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to inject arbitrary web script or HTML via the 1 cid or 2 uids parameter...

Sql injection

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the 1 usergroups parameter to admin/code/tceedittest.php or 2 subjectid parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/code/tceselectuserspopup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to inject arbitrary web script or HTML via the 1 cid or 2 uids parameter...

CVE-2012-4601

Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the 1 usergroups parameter to admin/code/tceedittest.php or 2 subjectid parameter to...

CVE-2012-4602

TCExam (Nicola Asuni) before 11.3.009 is affected by XSS in admin/code/tce_select_users_popup.php, via unsanitized inputs in the cid and uids GET parameters, enabling arbitrary script/HTML in admin sessions. Root cause: lack of input sanitization. Exploitation details are described in linked advi...

CVE-2012-4601

CVE-2012-4601 affects Nicola Asuni TCExam before 11.3.009. The vulnerability is an SQL injection caused by improper sanitization of input in two parameters: the POST parameter user_groups[] to admin/code/tce_edit_test.php and the POST parameter subject_id to admin/code/tce_show_all_questions.php....

TCExam Edit Cross-Site Scripting

/---------------------------------- | TCExam Edit Cross-Site Scripting | ----------------------------------/ Summary ======= TCExam 11.3.007 is subject to a cross-site scripting vulnerability. A 'questionsubjectid' parameter is not sufficiently sanitised before being written to the...