CVE-2026-4169

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4169", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-14T12:47:26.433Z", "datePublished": "2026-03-15T06:02:09.933Z", "dateUpdated": "2026-03-16T15:43:55.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T06:02:09.933Z"}, "title": "Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "Tecnick", "product": "TCExam", "versions": [{"version": "16.0", "status": "affected"}, {"version": "16.1", "status": "affected"}, {"version": "16.2", "status": "affected"}, {"version": "16.3", "status": "affected"}, {"version": "16.4", "status": "affected"}, {"version": "16.5", "status": "affected"}, {"version": "16.6.0", "status": "affected"}, {"version": "16.6.1", "status": "unaffected"}], "cpes": ["cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*"], "modules": ["XML Export"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. There are still doubts about whether this vulnerability truly exists. Upgrading to version 16.6.1 is able to address this issue. The patch is named 899b5b2fa09edfe16043f07265e44fe2022b7f12. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: \"However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective.\" This is reflected by the CVSS vector."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-14T13:53:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.351076", "name": "VDB-351076 | Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351076", "name": "VDB-351076 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12", "tags": ["patch"]}, {"url": "https://github.com/tecnickcom/tcexam/releases/tag/16.6.1", "tags": ["patch"]}], "tags": ["disputed", "x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T15:43:41.541043Z", "id": "CVE-2026-4169", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:43:55.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4169", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T15:43:41.541043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:43:47.713Z"}}], "cna": {"tags": ["disputed", "x_open-source"], "title": "Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting", "credits": [{"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*"], "vendor": "Tecnick", "modules": ["XML Export"], "product": "TCExam", "versions": [{"status": "affected", "version": "16.0"}, {"status": "affected", "version": "16.1"}, {"status": "affected", "version": "16.2"}, {"status": "affected", "version": "16.3"}, {"status": "affected", "version": "16.4"}, {"status": "affected", "version": "16.5"}, {"status": "affected", "version": "16.6.0"}, {"status": "unaffected", "version": "16.6.1"}]}], "timeline": [{"lang": "en", "time": "2026-03-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-14T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-14T13:53:03.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351076", "name": "VDB-351076 | Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351076", "name": "VDB-351076 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12", "tags": ["patch"]}, {"url": "https://github.com/tecnickcom/tcexam/releases/tag/16.6.1", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. There are still doubts about whether this vulnerability truly exists. Upgrading to version 16.6.1 is able to address this issue. The patch is named 899b5b2fa09edfe16043f07265e44fe2022b7f12. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: \"However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective.\" This is reflected by the CVSS vector."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T06:02:09.933Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4169", "state": "PUBLISHED", "dateUpdated": "2026-03-16T15:43:55.190Z", "dateReserved": "2026-03-14T12:47:26.433Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-15T06:02:09.933Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*"], "modules": ["XML Export"], "product": "TCExam", "vendor": "Tecnick", "versions": [{"status": "affected", "version": "16.0"}, {"status": "affected", "version": "16.1"}, {"status": "affected", "version": "16.2"}, {"status": "affected", "version": "16.3"}, {"status": "affected", "version": "16.4"}, {"status": "affected", "version": "16.5"}, {"status": "affected", "version": "16.6.0"}, {"status": "unaffected", "version": "16.6.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. There are still doubts about whether this vulnerability truly exists. Upgrading to version 16.6.1 is able to address this issue. The patch is named 899b5b2fa09edfe16043f07265e44fe2022b7f12. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: \"However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective.\" This is reflected by the CVSS vector."}, {"lang": "es", "value": "Se ha descubierto un fallo de seguridad en Tecnick TCExam hasta la versi\u00f3n 16.6.0. Afecta a la funci\u00f3n F_xml_export_users del archivo admin/code/tce_xml_users.PHP del componente XML Export. Realizar una manipulaci\u00f3n resulta en cross-site scripting. La explotaci\u00f3n remota del ataque es posible. Todav\u00eda existen dudas sobre si esta vulnerabilidad realmente existe. Actualizar a la versi\u00f3n 16.6.1 puede solucionar este problema. El parche se denomina 899b5b2fa09edfe16043f07265e44fe2022b7f12. Se sugiere actualizar el componente afectado. Cuando se inform\u00f3 al proveedor sobre otro problema de seguridad, identific\u00f3 y corrigi\u00f3 este fallo durante el an\u00e1lisis. Duda del impacto de esto: 'Sin embargo, esto es dif\u00edcil de justificar como un problema de seguridad. Requiere ser administrador tanto para crear como para consumir el exploit. Los administradores pueden hacer pr\u00e1cticamente cualquier cosa en la plataforma, as\u00ed que no le veo el sentido desde una perspectiva de seguridad.' Esto se refleja en el vector CVSS."}], "id": "CVE-2026-4169", "lastModified": "2026-06-17T10:56:06.293", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4169", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T15:43:41.541043Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:56.593", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12"}, {"source": "cna@vuldb.com", "url": "https://github.com/tecnickcom/tcexam/releases/tag/16.6.1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351076"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351076"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "16.6.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "16.6.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "TCExam", "source": "cna", "vendor": "Tecnick"}, "product": "tcexam", "vendor": "tecnick"}], "analysis": {"en": {"generated_at": "2026-03-21T14:40:30.797835+00:00", "value": {"mitigation_remediation": ["Upgrade to Tecnick TCExam 16.6.1 or newer using the official release or apply the commit 899b5b2fa09edfe16043f07265e44fe2022b7f12 to the affected file. If an upgrade is not immediately possible, disable the XML export function for non\u2011trusted users until a fix is available. Verify that exported XML contents are properly escaped and monitor logs for signs of unexpected script execution."], "summary": {"action": "Patch", "impact": "Cross Site Scripting"}, "threat_synthesis": {"affected_systems": "Affected versions are all releases of Tecnick TCExam up to, and including, 16.6.0. The control file involved is admin/code/tce_xml_users.php. Version 16.6.1 contains the fix, referenced by the commit hash 899b5b2fa09edfe16043f07265e44fe2022b7f12. The patch is included in the 16.6.1 release on the vendor\u2019s site and GitHub.", "description_and_impact": "The vulnerability is a cross\u2011site scripting flaw in the XML export function (F_xml_export_users) of Tecnick TCExam. An attacker who can manipulate the XML export payload can inject malicious script that will be executed in the context of an administrator browsing the exported file. The flaw is tied to CWE\u201179 and CWE\u201194, indicating input validation and potentially code injection issues. While the vendor has expressed uncertainty about the real impact, the symptom allows arbitrary script execution when the exploit is executed.", "risk_and_exploitability": "CVSS scores place the severity at 4.8, a moderate rating, and the EPSS score is below 1\u202f%, indicating that exploit attempts are expected to be rare. The vulnerability is not catalogued in the CISA KEV list, which further suggests low exploitation likelihood. Remote exploitation is theoretically possible but requires administrative access to create an export and then consume it, meaning that an attacker with such privileges can already accomplish most control functions. In effect, the risk to a system lacking privileged user compromise is limited, and the practical threat is moderate."}}}}, "created": "2026-03-16T09:22:04.171118+00:00", "updated": "2026-03-23T14:01:59.716118+00:00", "vendors": ["tecnick", "tecnick$PRODUCT$tcexam"]}