Threat database

CVE-2026-4169 is a cross-site scripting (XSS) vulnerability found in Tecnick TCExam versions up to 16.6.0, specifically in the XML export functionality for users. The flaw exists in the F_xml_export_users function within admin/code/tce_xml_users.php. Exploitation requires an attacker to have administrator privileges to both create and trigger the exploit, limiting its practical impact. The vulnerability allows injection of malicious scripts that could be executed in the context of an administrator's browser session. The vendor has released version 16.6.1 to address this issue.

CVE-2026-4168 is a medium severity cross-site scripting (XSS) vulnerability found in Tecnick TCExam version 16.5.0, specifically in the /admin/code/tce_edit_group.php file within the Group Handler component. The vulnerability arises from improper sanitization of the 'Name' argument, allowing remote attackers to inject malicious scripts. Exploitation requires high privileges and user interaction, and no authentication bypass is indicated. Although a public exploit exists, the vendor has indicated that the issue could not be reproduced in later versions, suggesting it has been fixed. Organizations using TCExam 16.5.0 or earlier should upgrade to the latest version to mitigate risk.

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

An issue was discovered in TCPDF before 6.8.0.unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.

An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.

An issue was discovered in TCPDF before 6.8.0.setSVGStyles does not sanitize the SVG font-family attribute.