Plattform
php
Komponente
cvesmarz
Behoben in
16.5.1
CVE-2026-4168 describes a cross-site scripting (XSS) vulnerability affecting Tecnick TCExam version 16.5.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability resides within the 'Name' argument of the /admin/code/tceeditgroup.php file and can be exploited remotely. While a fix is recommended, the vendor indicates that later versions may already address the issue.
Successful exploitation of CVE-2026-4168 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser session. This can lead to various malicious actions, including stealing session cookies, redirecting users to phishing sites, or defacing the application's interface. The impact is amplified if the application is used to manage sensitive data or handle critical operations. Given the publicly available exploit, the risk of exploitation is elevated, particularly for systems running the vulnerable version without immediate patching. The attack vector is remote, meaning an attacker doesn't require local access to the system.
CVE-2026-4168 has a LOW CVSS score of 2.4. A public proof-of-concept (PoC) is available, indicating a higher likelihood of exploitation. The vulnerability was disclosed on 2026-03-15. While active exploitation is not explicitly confirmed, the presence of a PoC suggests that attackers may be actively scanning for and exploiting vulnerable systems. The vendor's statement regarding mitigation in later versions introduces some uncertainty, but upgrading remains the recommended course of action.
Organizations using Tecnick TCExam version 16.5.0, particularly those with publicly accessible administration interfaces, are at risk. Shared hosting environments where multiple users share the same TCExam instance are also at increased risk, as an attacker could potentially compromise other users' accounts.
• wordpress / composer / npm:
grep -r "tce_edit_group.php" /var/www/html/• generic web:
curl -I http://your-tc-exam-site.com/admin/code/tce_edit_group.php | grep -i "X-Powered-By"disclosure
Exploit-Status
EPSS
0.03% (9% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2026-4168 is to upgrade to a patched version of Tecnick TCExam. While the vendor claims later versions may already contain the fix, verifying the specific version and applying any available updates is crucial. As a temporary workaround, input validation and output encoding on the 'Name' parameter in /admin/code/tceeditgroup.php can help prevent XSS attacks. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious JavaScript injection attempts. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the 'Name' field and verifying that it is properly sanitized.
Aktualisieren Sie auf eine Version nach 16.5.0 von TCExam. Laut dem Vendor wurde das Problem in einer späteren Version behoben, obwohl nicht angegeben wird, welche. Es wird empfohlen, die neueste verfügbare Version zu erhalten.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-4168 is a cross-site scripting (XSS) vulnerability in Tecnick TCExam version 16.5.0, allowing attackers to inject malicious scripts via the 'Name' parameter in /admin/code/tceeditgroup.php.
If you are using Tecnick TCExam version 16.5.0, you are potentially affected. The vendor suggests later versions may be patched, so verify your version.
Upgrade to a patched version of Tecnick TCExam. Implement input validation and output encoding as a temporary workaround.
While active exploitation is not confirmed, a public proof-of-concept exists, suggesting a potential risk of exploitation.
Refer to the vendor's official communication channels and security advisories for the most up-to-date information regarding CVE-2026-4168.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.