CVE-2025-41015

User Enumeration vulnerability in TCMAN GIM

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebService.asmx'.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-41014

User Enumeration vulnerability in TCMAN GIM

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebService.asmx'.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-41013

SQL injection vulnerability in TCMAN GIM

SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-41012

Unauthorized access vulnerability in TCMAN GIM

Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40664

Missing authentication vulnerability in TCMAN GIM v11

Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40665

Time-based blind SQL injection vulnerability in TCMAN GIM v11

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40666

Time-based blind SQL injection vulnerability in TCMAN GIM v11

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40667

Missing authorization vulnerability in TCMAN GIM v11

Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40668

Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40669

Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&amp;Page=-1.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40670

Incorrect Authorization vulnerability in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40625

Multiple vulnerabilities in TCMAN's GIM

Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40624

Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “email” parameters of the ‘updatePassword’ endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40623

Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘Sender’ and “email” parameters of the ‘createNotificationAndroid’ endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40622

Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ parameter of the ‘GetLastDatePasswordChange’ endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40621

Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndGetData’ endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2025-40620

Multiple vulnerabilities in TCMAN's GIM

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndWS’ endpoint.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2022-36277

SQL injection vulnerability in TCMAN GIM

The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2022-36276

SQL injection vulnerability in TCMAN GIM

TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim

CVE-2021-4046

TCMAN GIM Cross-Site Scripting (XSS)

The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tcman

Products

Gim