CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-20112
https://notcve.org/view.php?id=CVE-2021-20112
A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_select_mediafile.php could upload a malicious javascript payload which would be triggered when another user views the file. Se presenta una vulnerabilidad de tipo cross-site scripting almacenada en TCExam versiones anteriores a 14.8.1 incluyéndola. Unos archivos válidos cargados por medio del archivo tce_select_mediafile.php con un nombre de archivo que comience por un punto será renderizado como text/html. • https://www.tenable.com/security/research/tra-2021-32 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-20111
https://notcve.org/view.php?id=CVE-2021-20111
A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_filemanager.php could upload a malicious javascript payload which would be triggered when another user views the file. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en TCExam versiones anteriores a 14.8.1 incluyéndola. Unos archivos válidos cargados por medio del archivo tce_filemanager.php con un nombre de archivo que comience con un punto, será renderizado como text/html. • https://www.tenable.com/security/research/tra-2021-32 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13422
https://notcve.org/view.php?id=CVE-2018-13422
TCExam before 14.1.2 has XSS via an ff_ or xl_ field. TCExam en versiones anteriores a la 14.1.2 tiene Cross-Site Scripting (XSS) mediante un campo ff_ or xl_. • https://github.com/tecnickcom/tcexam/pull/223 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 102EXPL: 1CVE-2012-4601
https://notcve.org/view.php?id=CVE-2012-4601
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php. Multiples vulnerabilidades de inyección SQL en Nicola Asuni TCExam anterior a v11.3.009 permite a usuarios remotos autenticados con nivel 5 o mayores permisos, ejecutar comandos SQL de su elección a través del parámetro (1) user_groups[] para admin/code/tce_edit_test.php o (2) subject_id para admin/code/tce_show_all_questions.php. • http://freecode.com/projects/tcexam/releases/347588 http://secunia.com/advisories/50539 http://sourceforge.net/projects/tcexam/files/CHANGELOG.TXT/view http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Ba=commit%3Bh=3e1ed3c02122eae182f076daabe903b0c8837971 https://www.htbridge.com/advisory/HTB23111 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-4602
https://notcve.org/view.php?id=CVE-2012-4602
Multiple cross-site scripting (XSS) vulnerabilities in admin/code/tce_select_users_popup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to inject arbitrary web script or HTML via the (1) cid or (2) uids parameter. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en admin/code/tce_select_users_popup.php en Nicola Asuni TCExam anterior a v11.3.009, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetro (1) cid o (2) uids. • http://freecode.com/projects/tcexam/releases/347588 http://secunia.com/advisories/50539 http://sourceforge.net/projects/tcexam/files/CHANGELOG.TXT/view http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Ba=commit%3Bh=3e1ed3c02122eae182f076daabe903b0c8837971 https://www.htbridge.com/advisory/HTB23111 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •