AndSoft vulnerabilities
We track 11 vulnerabilities in AndSoft products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2025.
Latest AndSoft vulnerabilities
- 7.5 High severity
e-TMS: Use of a Broken or Risky Cryptographic Algorithm
Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to coll
- 7.5 High severity
e-TMS: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”.
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter i
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'