Changing vulnerabilities
We track 7 vulnerabilities in Changing products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Changing vulnerabilities
- 8.8 High severity
CGServiSign: Improper Neutralization of Special Elements used in an OS Command
CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution o
- 9.8 Critical severity
IDExpert Windows Logon Agent: Download of Code Without Integrity Check
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
- 9.8 Critical severity
IDExpert Windows Logon Agent: Download of Code Without Integrity Check
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
- 9.8 Critical severity
TSA: Missing Authentication for Critical Functionality
TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.
- 7.5 High severity
Clinic Image System: Improper Neutralization of Special Elements used in an SQL Command
Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
- 9.8 Critical severity
Clinic Image System: Use of Hard-coded Credentials
Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code.
- 7.2 High severity
Mobile One Time Password: Unrestricted Upload of File with Dangerous Type
CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.