Description
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
Published: 2025-12-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

The vulnerabilitiy has been fixed by the TCMAN team in version 20250401.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 03 Dec 2025 20:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 02 Dec 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 02 Dec 2025 13:30:00 +0000

Type Values Removed Values Added
Description SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
Title SQL injection vulnerability in TCMAN GIM
First Time appeared Tcman
Tcman gim
Weaknesses CWE-89
CPEs cpe:2.3:a:tcman:gim:*:*:*:*:*:*:*:*
Vendors & Products Tcman
Tcman gim
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tcman Gim
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2025-12-02T14:22:40.733Z

Reserved: 2025-04-16T09:08:43.218Z

Link: CVE-2025-41013

cve-icon Vulnrichment

Updated: 2025-12-02T14:22:35.830Z

cve-icon NVD

Status : Analyzed

Published: 2025-12-02T14:16:24.437

Modified: 2025-12-03T19:54:41.300

Link: CVE-2025-41013

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses