PT-2026-25542 · Tecnick+1 · Tcexam

Vuldb · CVE-2026-4169 · Published 2026-03-15 · Updated 2026-03-16

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions Tecnick TCExam versions up to 16.6.0

Description A security issue exists in Tecnick TCExam related to the XML Export component. The F xml export users function within the admin/code/tce xml users.php file is susceptible to cross site scripting. Exploitation may be possible remotely. The vendor has expressed doubts about the severity of this issue, noting that it requires administrator privileges for both creation and exploitation, and that administrators already possess extensive capabilities within the platform.

Recommendations Tecnick TCExam versions up to 16.6.0 should be upgraded to version 16.6.1 to address this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-4169

Affected Products

Tcexam

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4169.json · Exploit
• https://github.com/tecnickcom/tcexam/releases/tag/16.6.1 · Patch
• https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12 · Patch
• https://osv.dev/vulnerability/CVE-2026-4169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4169 · Security Note
• https://vuldb.com/?ctiid.351076 · Note
• https://vuldb.com/?id.351076 · Note
• https://t.me/CVEtracker/47416 · Telegram Post
• https://twitter.com/CVEnew/status/2033194284451758090 · Twitter Post
• https://twitter.com/cyberbivash/status/2033101899839189195 · Twitter Post