Persistent Cross-Site Scripting in TCExam 14.2.2 Affects Users
CVE-2020-5748

6.1MEDIUM

Key Information:

Vendor

Tecnick

Status
Tcexam
Vendor
CVE Published:
7 May 2020

What is CVE-2020-5748?

Insufficient output sanitization in TCExam version 14.2.2 exposes users to persistent cross-site scripting (XSS) attacks. Attackers can exploit this vulnerability through the self-registration feature, allowing them to inject malicious scripts that may execute in the browsers of other users. As a result, sensitive information may be compromised without the need for authentication, posing significant security risks to both users and the application.

Affected Version(s)

TCExam 14.2.2

References

https://www.tenable.com/security/research/tra-2020-31
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-5748 : Persistent Cross-Site Scripting in TCExam 14.2.2 Affects Users