The vulnerability in the tce_select_mediafile.php function of the TCExam electronic examination system allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability in the tceselectmediafile.php file of the TCExam electronic examination system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...

CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

CVE-2021-20112: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in TCExam = 14.8.1. Valid files uploaded via tceselectmediafile.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tceselectmediafile.php could upload a malicious javascript payload which would b...