CVE-2026-4169: XSS in TCExam 16.0–16.6.1

The XSS vulnerability in TCExam allows an attacker to inject malicious scripts into web pages viewed by users of the application. This can be exploited to steal user credentials, redirect users to phishing sites, or deface the application's interface. The impact is amplified if the TCExam application is used to manage sensitive data or if it is integrated with other systems. While the vulnerability is rated as low severity, successful exploitation can still compromise user accounts and potentially lead to further attacks if the attacker gains access to administrative privileges. The ability to remotely exploit this vulnerability without authentication increases the potential for widespread impact.

1. Reserved2026-03-14
2. Published2026-03-15
3. Modified2026-03-16
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-4169 is to upgrade TCExam to version 16.6.1, which includes the necessary patch (899b5b2fa09edfe16043f07265e44fe2022b7f12). If immediate upgrading is not possible, consider implementing input validation and output encoding on user-supplied data within the XML Export functionality as a temporary workaround. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to trigger the XML export function with a crafted payload containing JavaScript code; the code should not execute.