23 matches found
CVE-2021-20114
CVE-2021-20114 affects TCExam
CVE-2021-20111
CVE-2021-20111 concerns a stored cross-site scripting vulnerability in TCExam
CVE-2021-20116
TCExam is affected by a reflected XSS vulnerability (CVE-2021-20116) in versions up to 14.8.4, caused by improper validation of path parameters in tce_select_mediafile.php (f, d, and dir). An attacker can craft a malicious link that, when clicked by an administrator, may hijack the administrator’...
CVE-2021-20113
CVE-2021-20113 affects TCExam
CVE-2020-5744
CVE-2020-5744 affects Tecnick.com TCExam 14.2.2. The vulnerability is a Relative Path Traversal that could allow a remote, authenticated attacker to read arbitrary files on disk. The connected records confirm the product/version and impact, but do not provide exploit details, affected editions be...
CVE-2020-5745
CVE-2020-5745 : TCExam 14.2.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. A remote attacker can induce a user to perform sensitive actions by tricking them into clicking a crafted link. The NVD CVSS data shows a base score of 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/I:H/A:N) and 4.3 (CV...
CVE-2023-6554
CVE-2023-6554 affects Tecnick TCExam (admin folder). The root cause is insufficient external authorization protection in the admin directory, allowing any user to download protected information such as exam answers when access is not gated by mechanisms like Apache Basic Auth. Impact is confident...
CVE-2020-5748
CVE-2020-5748 affects Tecnick.com TCExam, specifically version 14.2.2, with a vulnerability in the self-registration flow due to insufficient output sanitization that enables a remote, unauthenticated attacker to perform persistent cross-site scripting (XSS). The connected sources corroborate a c...
CVE-2020-5751
TCExam 14.2.2 is affected by a vulnerability described as insufficient output sanitization that enables a remote, authenticated attacker to perform persistent cross-site scripting (XSS) by creating a crafted operator. The issue is documented across multiple sources (e.g., CVE-2020-5751 and relate...
CVE-2011-3806
TCExam 11.1.015 is affected by an information-disclosure vulnerability: a remote attacker can trigger an error in a direct request to a PHP file (e.g., public/code/tce_page_footer.php) and obtain the installation path. This is documented across multiple sources (NVD/Red Hat/CVEs) and is described...
CVE-2012-4237
CVE-2012-4237 affects TCExam prior to 11.3.008. A SQL injection flaw exists in the tce_edit_answer.php and tce_edit_question.php paths where the subject_module_id parameter is unsafely included in SQL statements. An authenticated user with permission level 5 or higher can potentially execute arbi...
CVE-2012-4238
TCExam is affected by a Cross-Site Scripting (XSS) vulnerability CVE-2012-4238 in admin/code/tce_edit_answer.php. The issue occurs before version 11.3.008 and allows remote authenticated users with permission level 5 (administrator) or higher to inject arbitrary JavaScript/HTML via the question_s...
CVE-2020-5750
Summary: CVE-2020-5750 affects Tecnick.com TCExam 14.2.2. The issue is insufficient output sanitization in the self-registration feature, enabling a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS). What’s affected: TCExam 14.2.2 (web-based e-exam system) as descr...
CVE-2010-2153
Affected software: TCExam (versions 10.1.006 and 10.1.007). Vulnerable component: admin/code/tce_functions_tcecode_editor.php. Root cause / vulnerability type: Unrestricted file upload allowing an uploaded file with an executable extension to be stored and then accessed via a direct request to th...
CVE-2012-4601
CVE-2012-4601 affects Nicola Asuni TCExam before 11.3.009. The vulnerability is an SQL injection caused by improper sanitization of input in two parameters: the POST parameter user_groups[] to admin/code/tce_edit_test.php and the POST parameter subject_id to admin/code/tce_show_all_questions.php....
CVE-2012-4602
TCExam (Nicola Asuni) before 11.3.009 is affected by XSS in admin/code/tce_select_users_popup.php, via unsanitized inputs in the cid and uids GET parameters, enabling arbitrary script/HTML in admin sessions. Root cause: lack of input sanitization. Exploitation details are described in linked advi...
CVE-2020-5747
TCExam 14.2.2 contains a cross-site scripting (XSS) vulnerability due to insufficient output sanitization. A remote, authenticated attacker can create a crafted test to persist XSS. No patch/firmware version or remediation is detailed in the provided documents.
CVE-2020-5749
TCExam 14.2.2 is affected by insufficient output sanitization, enabling remote, authenticated attackers to perform persistent cross-site scripting by creating specially crafted groups. The issue is documented across multiple sources (NVD/Red Hat etc.) with impact described as persistent XSS; no s...
CVE-2020-5743
This entry documents CVE-2020-5743 affecting TCExam 14.2.2. The vulnerability is described as improper access control (improper control of resource identifiers) that lets a remote, authenticated attacker access test metadata they should not be able to view. The connected records consistently iden...
CVE-2020-5746
Summary: CVE-2020-5746 is a vulnerability in Tecnick.com TCExam (version 14.2.2) characterized by insufficient output sanitization that enables a remote, authenticated attacker to perform persistent cross-site scripting (XSS) by crafting a test. Affected component: TCExam web application (TCExam ...
CVE-2018-13422
TCExam prior to 14.1.2 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via inputs in ff_ or xl_ fields. The issue affects the web-based open source TCExam system and is documented across multiple sources (e.g., CNVD-2018-13449, NVD/CVE-2018-13422, Red Hat advisory)...