VULNERABILITY INTELLIGENCE

CVE-2025-40622

CVSS score9.3 CRITICAL
EPSS probability0.44%
CISA KEVNot currently listed
Published2025-05-06
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ parameter of the ‘GetLastDatePasswordChange’ endpoint.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references