CVE-2025-40667

CVE-2025-40667 describes a missing authorization vulnerability in TCMAN’s GIM v11. An authenticated attacker can access functions not exposed via the UI by modifying the HTTP response status from ‘302 Found’ to ‘200 OK’ and tampering with hidden fields hdnReadOnly and hdnUserLogin. The CVE docume...