Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
TcmanGim

13 matches found

CVE
CVE•added 2025/05/26 1:15 p.m.•62 views

CVE-2025-40666

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.

8.7CVSS8.1AI score0.00039EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•55 views

CVE-2025-40625

Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).

9.8CVSS7.2AI score0.00265EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•47 views

CVE-2025-40622

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ para...

9.8CVSS7.3AI score0.00141EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•47 views

CVE-2025-40623

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘Sender’ and “e...

9.8CVSS7.3AI score0.00141EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•47 views

CVE-2025-40624

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “ema...

9.8CVSS7.3AI score0.00141EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•46 views

CVE-2025-40620

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ paramete...

9.8CVSS7.3AI score0.00141EPSS
CVE
CVE•added 2025/05/06 11:15 a.m.•46 views

CVE-2025-40621

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ paramete...

9.8CVSS7.3AI score0.00141EPSS
CVE
CVE•added 2025/06/09 1:15 p.m.•42 views

CVE-2025-40668

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChang...

7.1CVSS6.7AI score0.0005EPSS
CVE
CVE•added 2025/05/26 1:15 p.m.•41 views

CVE-2025-40664

Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.

9.3CVSS6.8AI score0.0015EPSS
CVE
CVE•added 2025/06/09 1:15 p.m.•41 views

CVE-2025-40669

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.

7.1CVSS6.4AI score0.00041EPSS
CVE
CVE•added 2025/05/26 1:15 p.m.•40 views

CVE-2025-40665

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.

8.7CVSS7.7AI score0.00039EPSS
CVE
CVE•added 2025/06/09 1:15 p.m.•40 views

CVE-2025-40670

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.

7.1CVSS6.5AI score0.0005EPSS
CVE
CVE•added 2025/05/26 1:15 p.m.•35 views

CVE-2025-40667

Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Fou...

8.7CVSS6.5AI score0.0005EPSS