Which versions of PHP are affected by CVE-2026-4168?

CVE-2026-4168 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4).. A patch is available.

Is there a public PoC exploit available for CVE-2026-4168?

Yes, a public proof-of-concept exploit is available for CVE-2026-4168. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4168?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

PHP CVE-2026-4168

Q: What is the CVSS score of CVE-2026-4168?

CVE-2026-4168 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12212 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-15 VulDB

PHP XSS Tcexam Tecnick

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 22, 2026 - 21:37 NVD

LOW MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

2.4 (LOW) 4.8 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 07:00 euvd

EUVD-2026-12212

Analysis Generated

Mar 15, 2026 - 07:00 vuln.today

Patch released

Mar 15, 2026 - 07:00 nvd

Patch available

CVE Published

Mar 15, 2026 - 06:02 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The presence of this vulnerability remains uncertain at this time. The affected component should be upgraded. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release.

AnalysisAI

A vulnerability was identified in Tecnick TCExam 16.5.0.

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.