Administrator-browser script execution via unsanitized username

Stored XSS in TCExam 14.2.2 allows remote attackers to execute JavaScript in an administrator's browser through self-registration. The self-registration username is stored and later passed without output encoding as the second argument to F_print_error() in tce_edit_user.php. Exploitation requires self-registration and an administrator to update or delete the crafted account, exposing that browser session to attacker-controlled script.