Threats affecting pkg:github/tecnickcom/tcexam

CVE-2026-4169 is a cross-site scripting (XSS) vulnerability found in Tecnick TCExam versions up to 16.6.0, specifically in the XML export functionality for users. The flaw exists in the F_xml_export_users function within admin/code/tce_xml_users.php. Exploitation requires an attacker to have administrator privileges to both create and trigger the exploit, limiting its practical impact. The vulnerability allows injection of malicious scripts that could be executed in the context of an administrator's browser session. The vendor has released version 16.6.1 to address this issue.

CVE-2026-4168 is a medium severity cross-site scripting (XSS) vulnerability found in Tecnick TCExam version 16.5.0, specifically in the /admin/code/tce_edit_group.php file within the Group Handler component. The vulnerability arises from improper sanitization of the 'Name' argument, allowing remote attackers to inject malicious scripts. Exploitation requires high privileges and user interaction, and no authentication bypass is indicated. Although a public exploit exists, the vendor has indicated that the issue could not be reproduced in later versions, suggesting it has been fixed. Organizations using TCExam 16.5.0 or earlier should upgrade to the latest version to mitigate risk.