CVE-2026-4169 | Low | 2.4 | 2026-03-16 | A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the… |
CVE-2026-4168 | Low | 2.4 | 2026-03-16 | A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Han… |
CVE-2025-23176 | High | 8.8 | 2025-04-22 | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2025-23175 | Medium | 6.1 | 2025-04-22 | Multiple XSS (CWE-79) |
CVE-2024-47926 | Critical | 9.8 | 2024-12-30 | Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
CVE-2024-47925 | High | 7.5 | 2024-12-30 | Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2024-56527 | High | 7.5 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. |
CVE-2024-56522 | High | 7.5 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF ta… |
CVE-2024-56521 | Critical | 9.8 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. |
CVE-2024-56520 | High | 7.3 | 2024-12-27 | An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and… |
CVE-2024-56519 | High | 7.5 | 2024-12-27 | An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. |
CVE-2023-6554 | Medium | 6.5 | 2024-01-11 | When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download pr… |
CVE-2021-20116 | Medium | 6.1 | 2021-08-05 | A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were… |
CVE-2021-20115 | Medium | 6.1 | 2021-08-05 | A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not p… |
CVE-2021-20114 | High | 7.5 | 2021-07-30 | When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which include… |
CVE-2021-20113 | Medium | 5.3 | 2021-07-30 | An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for an email address that was not registere… |
CVE-2021-20112 | Medium | 5.4 | 2021-07-30 | A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename beggining with a peri… |
CVE-2021-20111 | Medium | 5.4 | 2021-07-30 | A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period wi… |
CVE-2020-5751 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5750 | Medium | 6.1 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the se… |
CVE-2020-5749 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5748 | Medium | 6.1 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the se… |
CVE-2020-5747 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5746 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5745 | High | 7.4 | 2020-05-07 | Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a craf… |
CVE-2020-5744 | Medium | 4.9 | 2020-05-07 | Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk. |
CVE-2020-5743 | Medium | 4.3 | 2020-05-07 | Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission. |
CVE-2018-17057 | Critical | 9.8 | 2018-09-14 | An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper. |
CVE-2018-13422 | Medium | 6.1 | 2018-07-07 | TCExam before 14.1.2 has XSS via an ff_ or xl_ field. |
CVE-2012-4602 | | | 2012-11-23 | Multiple cross-site scripting (XSS) vulnerabilities in admin/code/tce_select_users_popup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to i… |
CVE-2012-4601 | | | 2012-11-23 | Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute a… |
CVE-2012-4238 | | | 2012-08-20 | Cross-site scripting (XSS) vulnerability in admin/code/tce_edit_answer.php in TCExam before 11.3.008 allows remote authenticated users with level 5 or greater… |
CVE-2012-4237 | | | 2012-08-20 | Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL… |
CVE-2011-3806 | | | 2011-09-24 | TCExam 11.1.015 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error me… |
CVE-2010-2153 | | | 2010-06-03 | Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 allows remote attackers to execute arbitr… |
CVE-2009-4747 | | | 2010-03-26 | PHP remote file inclusion vulnerability in public/code/cp_html2xhtmlbasic.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute ar… |
CVE-2009-3220 | | | 2009-09-16 | PHP remote file inclusion vulnerability in cp_html2txt.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code vi… |