CVE-2025-40621 CRITICAL

CVE-2025-40621: Multiple vulnerabilities in TCMAN's GIM

Vendor Tcman
Product GIM
Weakness CWE-89 · SQLi
Published May 6, 2025
Last update May 6, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndGetData’ endpoint.

Key dates

02Disclosure timeline

May 6, 2025 CVE published
May 6, 2025 Record updated