PT-2026-25542 · Tecnick+1 · Tcexam

Vuldb · Published 2026-03-15 · Updated 2026-03-16 · CVE-2026-4169

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tecnick TCExam versions up to 16.6.0

Description A security issue exists in Tecnick TCExam related to the XML Export component. The F xml export users function within the admin/code/tce xml users.php file is susceptible to cross site scripting. Exploitation may be possible remotely. The vendor has expressed doubts about the severity of this issue, noting that it requires administrator privileges for both creation and exploitation, and that administrators already possess extensive capabilities within the platform.

Recommendations Tecnick TCExam versions up to 16.6.0 should be upgraded to version 16.6.1 to address this issue.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-4169

Affected Products

Tcexam

References · 9

• https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12 · Patch
• https://github.com/tecnickcom/tcexam/releases/tag/16.6.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4169 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4169 · Vendor Advisory
• https://vuldb.com/?ctiid.351076 · Note
• https://vuldb.com/?id.351076 · Note
• https://t.me/CVEtracker/47416 · Telegram Post
• https://twitter.com/CVEnew/status/2033194284451758090 · Twitter Post
• https://twitter.com/cyberbivash/status/2033101899839189195 · Twitter Post