TMS vulnerabilities

2 known vulnerabilities in TMS from Xiweicheng. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  TMS: Server-Side Request Forgery

  CVE-2026-1062Jan 17, 2026Xiweicheng

  A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attac

• 9.8 Critical severity

  TMS: Unrestricted Upload of File with Dangerous Type

  CVE-2026-1061Jan 17, 2026Xiweicheng

  A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The a