CVE-2007-2431
Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site...
- Published
- May 2, 2007
- Updated
- Aug 7, 2024
- Assigning CNA
- mitre
- Evidence observed
- Apr 29, 2007
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:PLow · next 30 days
- Percentile
- 92.2%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.
Sources
rgod · php · Apr 29, 2007
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.