https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-41015.htmlhttps://patchthecve.com/cve/CVE-2025-41015.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 7.5: User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetUserQuestionAndAnswer' in '/WS/PDAWebSerhttps://patchthecve.com/cve/CVE-2025-41014.htmlhttps://patchthecve.com/cve/CVE-2025-41014.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 7.5: User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in '/WS/PDAWebSehttps://patchthecve.com/cve/CVE-2025-41013.htmlhttps://patchthecve.com/cve/CVE-2025-41013.htmlFri, 25 Sep 2026 23:10:00 +0000CRITICAL 9.8: SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.https://patchthecve.com/cve/CVE-2025-41012.htmlhttps://patchthecve.com/cve/CVE-2025-41012.htmlWed, 17 Jun 2026 09:22:25 +0000MEDIUM 5.3: Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.https://patchthecve.com/cve/CVE-2025-40670.htmlhttps://patchthecve.com/cve/CVE-2025-40670.htmlWed, 17 Jun 2026 09:21:55 +0000HIGH 8.8: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.https://patchthecve.com/cve/CVE-2025-40669.htmlhttps://patchthecve.com/cve/CVE-2025-40669.htmlWed, 17 Jun 2026 09:21:55 +0000MEDIUM 6.5: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&Page=-1.https://patchthecve.com/cve/CVE-2025-40668.htmlhttps://patchthecve.com/cve/CVE-2025-40668.htmlWed, 17 Jun 2026 09:21:55 +0000MEDIUM 6.5: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangehttps://patchthecve.com/cve/CVE-2025-40667.htmlhttps://patchthecve.com/cve/CVE-2025-40667.htmlWed, 17 Jun 2026 09:21:55 +0000MEDIUM 6.5: Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Founhttps://patchthecve.com/cve/CVE-2025-40666.htmlhttps://patchthecve.com/cve/CVE-2025-40666.htmlWed, 17 Jun 2026 09:21:55 +0000CRITICAL 9.8: Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx.https://patchthecve.com/cve/CVE-2025-40665.htmlhttps://patchthecve.com/cve/CVE-2025-40665.htmlWed, 17 Jun 2026 09:21:55 +0000CRITICAL 9.8: Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx.https://patchthecve.com/cve/CVE-2025-40664.htmlhttps://patchthecve.com/cve/CVE-2025-40664.htmlWed, 17 Jun 2026 09:21:55 +0000CRITICAL 9.1: Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.https://patchthecve.com/cve/CVE-2025-40625.htmlhttps://patchthecve.com/cve/CVE-2025-40625.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE).https://patchthecve.com/cve/CVE-2025-40624.htmlhttps://patchthecve.com/cve/CVE-2025-40624.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “emaihttps://patchthecve.com/cve/CVE-2025-40623.htmlhttps://patchthecve.com/cve/CVE-2025-40623.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘Sender’ and “emhttps://patchthecve.com/cve/CVE-2025-40622.htmlhttps://patchthecve.com/cve/CVE-2025-40622.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ paramhttps://patchthecve.com/cve/CVE-2025-40621.htmlhttps://patchthecve.com/cve/CVE-2025-40621.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameterhttps://patchthecve.com/cve/CVE-2025-40620.htmlhttps://patchthecve.com/cve/CVE-2025-40620.htmlWed, 17 Jun 2026 09:21:50 +0000CRITICAL 9.8: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter