CVE-2012-4601
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote...
CVE-2012-4601 is a medium vulnerability (CVSS 6.0) in Tecnick Tcexam, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. No source names a fixed version.
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
- Record
CVE-2012-4601- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
- Record
CVE-2012-4601- Updated
- 2026-11-02
EUVDEUVD-2012-4526 No score
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
- Record
EUVD-2012-4526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3g5-x76p-frj7 No score
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote...
Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the (1) user_groups[] parameter to admin/code/tce_edit_test.php or (2) subject_id parameter to admin/code/tce_show_all_questions.php.
- Record
GHSA-h3g5-x76p-frj7- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Ba=commit%3Bh=3e1ed3c02122eae182f076daabe903b0c8837971
secunia.com/advisories/50539
htbridge.com/advisory/HTB23111
sourceforge.net/projects/tcexam/files/CHANGELOG.TXT/view
freecode.com/projects/tcexam/releases/347588
nvd.nist.gov/vuln/detail/CVE-2012-4601
github.com/advisories/GHSA-h3g5-x76p-frj7