TCMAN vulnerabilities
We track 14 vulnerabilities in TCMAN products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on December 2, 2025.
Latest TCMAN vulnerabilities
- 7.5 High severity
GIM: Exposure of Sensitive Information to an Unauthorized Actor
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction Get
- 7.5 High severity
GIM: Exposure of Sensitive Information to an Unauthorized Actor
User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction Get
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.
- 8.8 High severity
GIM: Incorrect Authorization
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.
- 9.1 Critical severity
GIM: Missing Authentication for Critical Functionality
Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.
- 9.8 Critical severity
GIM: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the v
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the v
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the v
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the v
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the v
- 9.8 Critical severity
GIM: Improper Neutralization of Special Elements used in an SQL Command
TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database.