Toptech Systems vulnerabilities
We track 6 vulnerabilities in Toptech Systems products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest Toptech Systems vulnerabilities
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.
- 7.1 High severity
TMS7: Session Fixation
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
- 9.1 Critical severity
TMS7: Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
- 9.0 Critical severity
TMS7: Improper Neutralization of Special Elements used in an SQL Command
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.
- 8.8 High severity
RCU II+: Missing Authentication for Critical Functionality
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework