CVE-2025-41014: Exposure of Sensitive Information to an Unauthorized Actor

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in...

Tcman Gim SQL注入漏洞

Tcman Gim is a facility management software from the Spanish company Tcman designed for use on mobile devices. An SQL injection vulnerability exists in Tcman Gim v11, which stems from an SQL injection in the GetLastDatePasswordChange endpoint username parameter...

CVE-2025-40622: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’...