medium6.1
CVE-2021-20115
A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3.
Impact
A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tecnick | Tcexam | through 14.8.3 |