Description (CNA)
A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_filemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / TCExam | affected <= 14.8.3 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.