e-TMS vulnerabilities
11 known vulnerabilities in e-TMS from AndSoft. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
e-TMS: Use of a Broken or Risky Cryptographic Algorithm
Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to coll
- 7.5 High severity
e-TMS: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”.
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter i
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'
- 9.8 Critical severity
e-TMS: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm'