Tcman
Tcman GIM: vulnerabilidades y CVE
Tcman GIM tiene 24 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE24
Últimos 12 meses4
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-41015 | Media (6.9) | 0.30% | — | 2 dic 2025 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the… |
| CVE-2025-41014 | Media (6.9) | 0.30% | — | 2 dic 2025 | User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the… |
| CVE-2025-41013 | Alta (8.7) | 0.29% | — | 2 dic 2025 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in… |
| CVE-2025-41012 | Alta (8.7) | 0.25% | — | 2 dic 2025 | Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword'… |
| CVE-2025-40670 | Alta (7.1) | 0.33% | — | 9 jun 2025 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser. |
| CVE-2025-40669 | Alta (7.1) | 0.25% | — | 9 jun 2025 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a… |
| CVE-2025-40668 | Alta (7.1) | 0.27% | — | 9 jun 2025 | Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser,… |
| CVE-2025-40667 | Alta (8.7) | 0.27% | — | 26 may 2025 | Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the… |
| CVE-2025-40666 | Alta (8.7) | 0.38% | — | 26 may 2025 | Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx. |
| CVE-2025-40665 | Alta (8.7) | 0.38% | — | 26 may 2025 | Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx. |
| CVE-2025-40664 | Crítica (9.3) | 0.55% | — | 26 may 2025 | Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser. |
| CVE-2025-40625 | Crítica (9.3) | 0.70% | — | 6 may 2025 | Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE). |
| CVE-2025-40624 | Crítica (9.3) | 0.42% | — | 6 may 2025 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of… |
| CVE-2025-40623 | Crítica (9.3) | 0.42% | — | 6 may 2025 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of… |
| CVE-2025-40622 | Crítica (9.3) | 0.42% | — | 6 may 2025 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of… |
| CVE-2025-40621 | Crítica (9.3) | 0.42% | — | 6 may 2025 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of… |
| CVE-2025-40620 | Crítica (9.3) | 0.42% | — | 6 may 2025 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of… |
| CVE-2022-36277 | Media (6.1) | 0.33% | — | 4 oct 2023 | The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks. |
| CVE-2022-36276 | Crítica (9.8) | 0.77% | — | 4 oct 2023 | TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database. |
| CVE-2021-4046 | Media (5.4) | 0.44% | — | 11 feb 2022 | The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking… |
| CVE-2021-40853 | Alta (7.2) | 0.83% | — | 17 dic 2021 | TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The… |
| CVE-2021-40852 | Media (6.1) | 0.72% | — | 17 dic 2021 | TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote… |
| CVE-2021-40851 | Alta (7.5) | 1.3% | — | 17 dic 2021 | TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information. |
| CVE-2021-40850 | Crítica (9.8) | 0.94% | — | 17 dic 2021 | TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx. |