CVSS: 2.1EPSS: 0%CPEs: 101EXPL: 2CVE-2012-4238 – TCExam 11.3.007 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2012-4238
Cross-site scripting (XSS) vulnerability in admin/code/tce_edit_answer.php in TCExam before 11.3.008 allows remote authenticated users with level 5 or greater permissions to inject arbitrary web script or HTML via the question_subject_id parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/code/tce_edit_answer.php en TCExam anterior a v11.3.008 permite a usuarios autenticados con nivel 5 o permisos superiores, inyectar código web o HTML arbitrario a través del parámetro question_subject_id. TCExam version 11.3.007 suffers from a cross site scripting vulnerability. • http://archives.neohapsis.com/archives/bugtraq/2012-08/0090.html http://freecode.com/projects/tcexam/releases/347125 http://secunia.com/advisories/50141 http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742 http://www.reactionpenetrationtesting.co.uk/tcexam-cross-site-scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 101EXPL: 5CVE-2012-4237 – TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2012-4237
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php. Múltiples vulnerabilidades inyección de código SQL en TCExam anterior a v11.3.008 permite a usuarios remotos autenticados con nivel 5 o permisos superiores ejecutar comandos SQL arbitrarios a través del parámetro subject_module_id en (1) tce_edit_answer.php o (2) tce_edit_question.php. TCExam Edit version 11.3.007 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/37584 https://www.exploit-db.com/exploits/37585 http://archives.neohapsis.com/archives/bugtraq/2012-08/0079.html http://freecode.com/projects/tcexam/releases/347125 http://secunia.com/advisories/50141 http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742 http://www.openwall.com/lists/oss-security/2012/08/13/8 http://www.reactionpenetrationtesting.co.uk/tcexam-sql-injection.html http://www.securityfocus. • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •