ChangingTec vulnerabilities
We track 10 vulnerabilities in ChangingTec products across 5 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on March 2, 2026.
Latest ChangingTec vulnerabilities
- 9.8 Critical severity
IDExpert Windows Logon Agent: Download of Code Without Integrity Check
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
- 9.8 Critical severity
IDExpert Windows Logon Agent: Download of Code Without Integrity Check
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
- 7.2 High severity
IDExpert: Improper Neutralization of Special Elements used in an OS Command
IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server.
- 8.8 High severity
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not…
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrar
- 8.8 High severity
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not…
The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute ar
- 7.2 High severity
Mobile One Time Password: Unrestricted Upload of File with Dangerous Type
CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.
- 9.8 Critical severity
ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation.
ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can
- 7.5 High severity
MegaServiSignAdapter: Improper Limitation of a Pathname to a Restricted Directory
ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
- 7.8 High severity
ServiSign: Improper Limitation of a Pathname to a Restricted Directory
ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers the c
- 8.8 High severity
ServiSign: Improper Neutralization of Special Elements used in an OS Command
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allow