Read the docs
TI-2026-03617 Aliases CVE-2026-4169GHSA-rgqq-mw78-fj3h

Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. There are still doubts about whether this vulnerability truly exists. Upgrading to version 16.6.1 is able to address this issue. The patch is named 899b5b2fa09edfe16043f07265e44fe2022b7f12. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: "However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective." This is reflected by the CVSS vector.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed TCExam (Tecnick): 16.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TecnickTCExam16.0; 16.1; 16.2; 16.3; 16.4; 16.5; 16.6.016.6.1Patch availableCNA
  • TCExam VendorTecnick Affected 16.0; 16.1; 16.2; 16.3; 16.4; 16.5; 16.6.0 Fixed in 16.6.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:*——Tecnick
  • cpe:2.3:a:tecnick:tcexam:*:*:*:*:*:*:*:* Versions — — ·Tecnick

Remediation

  • Fix · CNA TCExam (Tecnick) Fixed in 16.6.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4169
  2. 2026-10-03 Alias added: GHSA-rgqq-mw78-fj3h

References

Patch 2

  • TI-2018-12189 An issue was discovered in TCPDF before 6.2.22. CVSS 3.0CRITICAL 9.8
  • TI-2026-03616 Tecnick TCExam Group tce_edit_group.php cross site scripting CVSS 4.0MEDIUM 4.8
  • TI-2024-37408 Improper certificate validation in Tecnick tcpdf CVSS 3.1CRITICAL 9.8
  • TI-2024-32179 Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS 3.1CRITICAL 9.8
  • TI-2021-03414 When installed following the default/recommended settings, TCExam <= 14.8.1 allowed… CVSS 3.1HIGH 7.5
  • TI-2025-16961 Tecnick – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS 3.1HIGH 8.8
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences