Unscored severity · published Nov 23, 2012
CVE-2012-4602
Multiple cross-site scripting (XSS) vulnerabilities in admin/code/tce_select_users_popup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to inject arbitrary web…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in admin/code/tce_select_users_popup.php in Nicola Asuni TCExam before 11.3.009 allow remote attackers to inject arbitrary web script or HTML via the (1) cid or (2) uids parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tcexam · Tecnick
through 11.3.008; 10.1.000; 10.1.001; 10.1.002; 10.1.003; 10.1.004; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4602
freecode.com
http://freecode.com/projects/tcexam/releases/347588
Vendor Advisory
http://secunia.com/advisories/50539
sourceforge.net
http://sourceforge.net/projects/tcexam/files/CHANGELOG.TXT/view
tcexam.git.sourceforge.net
http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Ba=commit%3Bh=3e1ed3c02122eae182f076daabe903b0c8837971
www.htbridge.com
https://www.htbridge.com/advisory/HTB23111
More from Tcexam
9.8
CVE-2024-47926
Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
8.8
CVE-2025-23176
Tecnick – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
7.5
CVE-2024-47925
Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7.5
CVE-2021-20114
When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database…
7.4
CVE-2020-5745
Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link