CVE-2007-2430

CVE-2007-2430 affects TCExam 4.0.011 and earlier. The vulnerability is in shared/code/tce_tmx.php, where an attacker can create arbitrary PHP files in cache/ by placing crafted content and directory-traversal data into a SessionUserLang cookie that is processed by public/code/index.php. This indi...

CVE-2007-2431

TCExam 4.0.011 and earlier are affected by a dynamic variable evaluation vulnerability in shared/config/tce_config.php. The flaw allows remote XSS by modifying critical variables (notably $_SERVER) via _SERVER[SCRIPT_NAME], enabling script injection and related impact as described in the CVE entr...

CVE-2007-6288

CVE-2007-6288 affects TCExam prior to 5.1.000 and involves multiple SQL injection vulnerabilities. The underlying issue is injection in SQL queries, allowing remote attackers to run arbitrary SQL via unspecified vectors. Reported impact per the entry indicates partial confidentiality, integrity, ...